design: extract document-as-is UI contract (DESIGN.md + DTCG tokens)

Case-B extract of the as-built dark UI into design/: 9-section DESIGN.md,
W3C DTCG tokens.tokens.json, brand/palette.css + assets, and inspiration/
provenance (incl. the rendered red-shade decision). Two owner calls layered
in: red elevated to the single brand accent (#DC2626), two-tier radius
(4px controls / 8px containers). AGENTS.md gains the read-before-UI Design
line + design/ in the layout tree; ROADMAP gains the design-checker cleanup
backlog. No UI code changed.

AGENTS.md

@@ -5,6 +5,9 @@ Self-hosted multi-user workout logger (Next.js app) packaged as a StartOS 0.4 `s
 > **Inbox check:** At session start, if `~/Projects/standards/INBOX.md` exists, scan it for
 > items tagged `(proof-of-work)` and surface them before proposing next steps; triage with `/triage`.
 
+> **Design:** before building or changing any user-facing UI, read `design/DESIGN.md` and
+> `design/tokens.tokens.json` and conform to them.
+
 ## Stack (versions that matter)
 
 - **Next.js 15** (App Router, server components + server actions, SSE streaming) — dynamic request APIs are async (see Conventions)
@@ -31,6 +34,7 @@ start9/0.4/               ← StartOS packaging wrapper
   docker_entrypoint.sh    ← boot: first-boot seed, additive ALTERs, library reconcile
   Makefile / s9pk.mk      ← s9pk build (ARCHES := x86)
   startos/versions/       ← one file per ExVer version + index.ts (the version graph)
+design/                   ← UI design contract: DESIGN.md + tokens.tokens.json (read before UI work); brand/ inspiration/
 ~/.proof-of-work/         ← publish.sh + unpublish.sh (NOT in repo; self-hosted registry)
 ```