Add /design round-trip and design-checker agent to the fleet

Design/branding for any user-facing repo becomes a vendor-neutral on-disk
contract — design/DESIGN.md (nine-section brief) + design/tokens.tokens.json
(W3C DTCG tokens) — that every agent reads before building UI. Claude Design
is the interchangeable cloud front-end, never a dependency.

- /design (main-thread command): inspiration-first scoping -> BRIEF.md -> user
  drives the cloud step -> distill the export back into the contract. Phase-C
  token distillation is agent-mediated because the export is inline-hardcoded
  HTML/CSS, not DTCG.
- design-checker (read-only subagent): audits a repo's UI against its own
  committed contract; says "run /design first" when none exists.
- /new-project scaffolds design/ for user-facing projects.

ROADMAP.md

@@ -131,6 +131,35 @@ allow-by-default and would have *un-ignored* `premier-gunner`'s password-bearing
   "scratch, don't track" decision.
 - **`start-os`** is an external upstream (Start9Labs/start-os) — out of scope, no action.
 
+## 8. Design system — `/design` round-trip + `design-checker` agent ✅ BUILT (2026-06-16)
+
+Built and live: `guides/design.md` + `adapters/claude/commands/design.md` (the `/design`
+command) and `guides/design-checker.md` + `adapters/claude/agents/design-checker.md` (the
+`design-checker` subagent). The principle: branding/design for any user-facing repo is a
+**vendor-neutral on-disk contract** — `design/DESIGN.md` (nine-section brand brief) +
+`design/tokens.tokens.json` (W3C DTCG tokens) — that every agent reads before building UI.
+The cloud tool (Anthropic's **Claude Design**, cloud-only/experimental) is an interchangeable
+front-end, never a dependency.
+
+- **`/design`** (main-thread, interactive) runs the round-trip: inspiration-first scoping →
+  `design/BRIEF.md` (the packet the user hand-carries to Claude Design) → user drives the
+  cloud step → distill the export back into the `DESIGN.md` + tokens contract. Distillation is
+  agent-mediated because Claude Design exports inline-hardcoded HTML/CSS, not DTCG tokens
+  (verified by research, 2026-06-16) — worth a human glance the first few runs.
+- **`design-checker`** (read-only subagent) audits a repo's user-facing code against its *own*
+  committed contract — off-palette colors, wrong type scale, magic-number spacing, matched
+  "don'ts" — citing code `file:line` vs the contract rule. Reports "run `/design` first" if no
+  contract exists; never imposes its own taste.
+- **`/new-project`** now scaffolds `design/` + the AGENTS.md Design line for user-facing
+  projects (Phase 4).
+
+**Remaining options:** (a) `/retrofit` should backfill `design/` into existing user-facing
+repos (keysat, recap, recaps.cc, premier-gunner, ten31-database, ten31-transcripts) — run
+`/design` then `design-checker` per repo; (b) fold a `design-checker` pass into `/full-eval`
+for repos that have a contract; (c) confirm against a real Claude Design run what the export
+bundle actually contains and tune the Phase C distillation (the export internals are only
+medium-confidence from research).
+
 ## 7. Verify & correct the placement guide ✅ DONE (2026-06-15)
 
 Walked the "Infrastructure facts" section with the owner and corrected it against the real