ci(client): run theme:lint as a per-file ratchet with the missing token rules

theme:lint only reported a total and exited 0, skipped whole files by name and
never ran in CI. It now counts per file under src/ against
scripts/theme-baseline.json, which only shrinks, like lint:rtl: the colour
literals, arbitrary colour classes and numeric font sizes it already saw, plus
palette classes (bg-gray-100, text-indigo-600, bg-white), raw text sizes
(text-sm, text-[13px]) instead of the type tiers, z-index literals above z-50
instead of a step of the layering scale, and reads of the dark_mode setting.
The file exemptions are gone; the map, PDF and brand files carry their count in
the baseline instead. theme-lint-disable markers stay valid in a comment and
are counted against scripts/theme-disable-baseline.json, like rtl-lint-disable
in lint:rtl; a new one raises its file's entry by hand, where review sees it.
The comment handling lint:rtl already had moves into scripts/lib/source.mjs so
both read source the same way.
The check runs in the client-quality job.

.github/workflows/test.yml

@@ -438,6 +438,14 @@ jobs:
         # Every translation key src/ names must exist in shared en.
         run: cd client && npm run lint:i18n-keys
 
+      - name: Theme tokens check
+        # Colour literals, palette classes, raw text sizes, z-index literals
+        # and reads of the dark_mode setting may hold no more per file than
+        # scripts/theme-baseline.json allows, and theme-lint-disable markers
+        # no more than scripts/theme-disable-baseline.json, so new surfaces
+        # follow the user's scheme, accent and text size (scripts/theme-lint.mjs).
+        run: cd client && npm run theme:lint
+
   plugin-sdk-quality:
     name: Plugin SDK Types
     needs: changes