Add design/ contract; archive prior design system as provenance

Establish keysat's durable, vendor-neutral design contract (the standards
/design backfill, document-as-is):

- design/DESIGN.md — nine-section brand brief distilled from the prior
  Claude Design system (navy-on-cream-paper identity, sovereignty-first
  voice, component + motion rules, do's/don'ts). Manrope is canonical
  display (the README's "Archivo" was a stale placeholder).
- design/tokens.tokens.json — W3C DTCG tokens from colors_and_type.css.
- design/brand/ — canonical palette.css + logo/mark assets.
- design/_imports/2026-06-16-claude-design-system/ — the original system,
  relocated as dated provenance (nothing imported it).
- AGENTS.md — add the Design line (read the contract before UI work);
  repoint the layout entry.
- ROADMAP.md — design-checker cleanup backlog (gold-as-fill + pill-radius
  blockers, the inline-token-copy consolidation, token gaps).

AGENTS.md

@@ -25,6 +25,7 @@ its guide** — see the index below.
 - Before building, bumping the version, or editing the StartOS wrapper, read `docs/guides/startos-packaging.md`.
 - Before editing the admin SPA (`web/index.html`), read `docs/guides/admin-ui.md`.
 - Before editing public site/docs copy, read `docs/guides/website-copy.md`.
+- **Before building or changing any user-facing UI (landing, docs, admin SPA), read `design/DESIGN.md` and `design/tokens.tokens.json` and conform to them** — the brand contract; pull colors/type/space/radii/shadows from the tokens, never hardcode off-scale values.
 - Before adding/altering tests or relying on lint/CI, read `docs/guides/testing.md`.
 
 ## Build / test / run (quick ref)
@@ -50,7 +51,7 @@ licensing-service-startos/        daemon + StartOS wrapper (s9pk package source)
 keysat-xyz-landing/ keysat-docs/ keysat-registry-landing/   public sites → guides/website-copy.md
 licensing-client-{rust,ts,python,go}/  the four SDK source repos
 activate-license-template/        Tauri desktop template for license activation
-keysat-design-system/             design tokens / brand assets
+design/                           design contract (DESIGN.md + tokens.tokens.json) + brand/ assets; original Claude Design system archived in design/_imports/
 plans/                            design specs (multi-provider-payment-model.md, keysat-smtp-emails.md)
 tests/crosscheck/                 cross-language LIC1 verifier → guides/crypto-wire-format.md
 ```