replace the monochrome theme with the CYBER neon-cyan skin

The project shipped a black-and-white theme that was only half converted:
the login page looked right, the message page was halfway, and the
settings page had not been started. This finishes the move to the CYBER
reference in prototype_reference/.

Colors now come from a single token source (styles/variables.scss), where
every semantic color is declared twice: once as OKLCH for the CSS, and
once as an RGB triple so translucent variants can be built as
rgba(var(--*-rgb), alpha). Cyan is the system itself, amber means the user
has to intervene, green means the machine is working, and red only ever
means something broke. The RGB triples are derived from the OKLCH values
so the two declarations cannot drift apart.

Pages adopt the .cy-* shell classes from the reference (view, panel,
kpis, tabs, grid, table, field) instead of ad-hoc markup, which is what
makes 19 of 26 views consistent. The remaining seven are deliberately
bespoke: chat streams, the kanban board, the workflow canvas, the
terminal, and the missing-agent screen.

The chart palette and the kanban column colors move into single-source
modules so they cannot drift either. A new guard test rejects raw hex
colors, named colors, and literal RGB triples anywhere in the client
source, with an explicit exemption list for the places that genuinely
cannot read a CSS variable. The existing chat semantics spec keeps the
chat chain honest.

No behavior changes: no logic, no i18n keys, no data structures, and the
/chat-run event contract is untouched.

scripts/harness-check.mjs

@@ -245,6 +245,71 @@ if (!buildWorkflow.includes('fetch-depth: 0')) {
   fail('Build workflow checkout must use fetch-depth: 0 so harness:check can inspect PR diffs')
 }
 
+// node-pty 的原生模块必须被编译出来。
+//
+// `npm ci --ignore-scripts` 会跳过所有 install 脚本，而 node-pty 的 install
+// 脚本正是把可加载的原生模块放到位的那个。少了它，终端功能会被静默禁用 ——
+// 服务端只打一条 warning 就继续跑，不会有任何失败信号。Linux 上 node-pty
+// 不发预编译产物，必须从源码编译，这一步是硬需求。
+//
+// 判据是「这个 workflow 是否真的需要原生模块」，不是「是否出现 npm ci」：
+//   * 跑测试或构建的 workflow —— 终端路由会被加载，少了原生模块就有问题；
+//   * 打包 node_modules 交付给用户的 workflow —— 交付物里必须带着能用的
+//     原生模块，否则用户装完发现终端功能是坏的。
+// npm-lockfile-check 只校验 lockfile 同步，不碰运行时，不需要这一步。
+const WORKFLOWS_NEEDING_NATIVE_MODULES = ['npm run test', 'npm run build', 'npm run test:e2e', 'npm prune']
+for (const workflowFile of await readdir(path.join(root, '.github/workflows'))) {
+  if (!workflowFile.endsWith('.yml') && !workflowFile.endsWith('.yaml')) continue
+  const relativeWorkflow = `.github/workflows/${workflowFile}`
+  const text = await readText(relativeWorkflow)
+  if (!text.includes('npm ci --ignore-scripts')) continue
+  const needsNativeModule = WORKFLOWS_NEEDING_NATIVE_MODULES.some(command => text.includes(command))
+  if (!needsNativeModule) continue
+  if (!text.includes('npm rebuild node-pty')) {
+    fail(
+      [
+        `${relativeWorkflow} installs dependencies with npm ci --ignore-scripts`,
+        'but does not run npm rebuild node-pty.',
+        'node-pty ships no prebuilt binary for Linux, so without the rebuild the',
+        'terminal feature is silently disabled on the runner.',
+      ].join(' '),
+    )
+  }
+}
+
+// macOS 没有被任何托管 runner 覆盖：Build 与 Playwright workflow 都跑在
+// ubuntu-latest 上。macOS 的验证必须以手动触发的方式存在，且不能挂在
+// 主流水线里 —— 没有 macOS runner 时，job 会永远停在等待状态，把整个
+// workflow 拖成 in progress。
+const macosWorkflowPath = '.github/workflows/macos-verification.yml'
+if (!existsSync(path.join(root, macosWorkflowPath))) {
+  fail(`Missing macOS verification workflow: ${macosWorkflowPath}`)
+} else {
+  const macosWorkflow = await readText(macosWorkflowPath)
+  if (!macosWorkflow.includes('workflow_dispatch')) {
+    fail('macOS verification workflow must be workflow_dispatch only: without a hosted macOS runner it would block the pipeline')
+  }
+  if (/^\s*push:/m.test(macosWorkflow) || /^\s*pull_request:/m.test(macosWorkflow)) {
+    fail('macOS verification workflow must not run on push or pull_request: no hosted macOS runner is available')
+  }
+  if (!macosWorkflow.includes('npm run harness:check')) {
+    fail('macOS verification workflow must run npm run harness:check')
+  }
+}
+
+// DEVELOPMENT.md 是新贡献者拿到跨平台仓库后的第一份指引。如果它漏了
+// node-pty 的编译步骤（Linux 上是硬需求），他们照着走会得到一个终端功能
+// 静默失效的环境，而且没有任何报错。
+const developmentDoc = await readText('DEVELOPMENT.md')
+for (const phrase of [
+  'npm rebuild node-pty',
+  'npm ci --ignore-scripts',
+]) {
+  if (!developmentDoc.includes(phrase)) {
+    fail(`DEVELOPMENT.md must document: ${phrase}`)
+  }
+}
+
 const chatSessionsDoc = await readText('docs/cli-chat-sessions.md')
 for (const phrase of [
   '最后重建时间',