docs: add .agents workspace and the Astro refactor plan

Adds the agent-facing workspace and a 20-task plan for migrating the site
to Astro. Nothing here implements the refactor; these are briefs, rules and
templates that the task agents read.

- .agents/ holds context, rules, checklists, skills, specialist agents,
  component/page/config templates and gate scripts. It is vendor-neutral so
  MiniMax, Gemini and Codex can all read it; CLAUDE.md just points at
  AGENTS.md.
- .husky/ plus .lintstagedrc.json wire the three gate tiers. gate.sh locks on
  the shared git-common-dir so parallel worktrees serialise, and guards the
  assertion count in scripts/verify.mjs against a coverage drop.
- plans/astro-refactor/ carries the phase graph, per-task briefs and the
  model-routing recommendation.

These files must be tracked before fanning out: a worktree only checks out
tracked files, so an untracked plan is invisible to every agent working in one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.agents/scripts/check-tokens.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+// Fails when a raw colour, px font-size, or ad-hoc breakpoint appears outside
+// the token layer. A rule nobody checks is a suggestion — wire this into
+// `npm run verify`.
+//
+// Usage: node .agents/scripts/check-tokens.mjs [srcDir]
+
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, extname } from 'node:path';
+
+// lint-staged appends staged file paths; a bare run sweeps `src`.
+const ARGS = process.argv.slice(2);
+const TOKEN_FILES = ['tokens.css', 'base.css'];
+const ALLOWED_BREAKPOINTS = ['560px', '800px', '1100px', '1600px', '2200px'];
+
+const walk = (dir) =>
+  readdirSync(dir).flatMap((name) => {
+    const path = join(dir, name);
+    return statSync(path).isDirectory() ? walk(path) : [path];
+  });
+
+const targets = ARGS.length
+  ? ARGS.flatMap((arg) => (statSync(arg).isDirectory() ? walk(arg) : [arg]))
+  : walk('src');
+
+const findings = [];
+
+for (const path of targets) {
+  if (!['.astro', '.css'].includes(extname(path))) continue;
+  if (TOKEN_FILES.some((allowed) => path.endsWith(allowed))) continue;
+
+  readFileSync(path, 'utf8').split('\n').forEach((line, index) => {
+    const at = `${path}:${index + 1}`;
+
+    // Raw hex — the drifted-palette failure mode this whole layer exists to stop.
+    const hex = line.match(/#[0-9a-fA-F]{3,8}\b/g);
+    if (hex) findings.push(`${at}: raw hex ${hex.join(', ')} — use a token from tokens.css`);
+
+    // rgb()/hsl() literals are the same problem wearing a different hat.
+    if (/\b(rgba?|hsla?)\(\s*\d/.test(line))
+      findings.push(`${at}: raw colour function — use a token`);
+
+    // Hard-coded font sizes bypass the type scale.
+    const fontSize = line.match(/font-size:\s*\d+(\.\d+)?px/);
+    if (fontSize) findings.push(`${at}: hard-coded ${fontSize[0]} — use var(--step-*)`);
+
+    // Ad-hoc breakpoints are how sixteen of them accumulated last time.
+    const media = line.match(/@media[^{]*?\(\s*(?:max|min)-width:\s*(\d+px)/);
+    if (media && !ALLOWED_BREAKPOINTS.includes(media[1]))
+      findings.push(`${at}: breakpoint ${media[1]} is not a named one (${ALLOWED_BREAKPOINTS.join(', ')})`);
+  });
+}
+
+if (findings.length) {
+  console.error(`token check failed — ${findings.length} finding(s):\n`);
+  findings.forEach((finding) => console.error(`  ${finding}`));
+  process.exit(1);
+}
+console.log('token check passed');