fix(ci): reconcile pages tests with the built landing SPA

[CodeWithJuber]

What & why

Every pipeline on master has been red since 27324a6, when the landing page became a built React/shadcn SPA. test/pages.test.js still enforced the old hand-authored static contract against landing/index.html, so six assertions failed — taking down Test (Node 20), Test (Node 22), Test (Windows / Git Bash), Quality gate, both Install smoke jobs, and Bump version / gate (the smoke and bump jobs just re-run npm test).

This was the only root cause: Biome, tsc, and docs check were already green.

PRs #110, #113, #114, #115, #116 are all Dependabot changes blocked purely by this inherited failure — nothing wrong with their own diffs.

Approach: keep the SPA, make the shell comply where it genuinely can, and scope the rest honestly rather than deleting the guarantee.

• landing/index.html — inline critical CSS carrying the brand.json colors (both schemes) and the shared system font stack. The shell shipped zero inline CSS, so it painted white until the jsDelivr chunks arrived; it now paints branded pre-hydration. Verified in Chromium with all HTTP blocked (no jsDelivr, no Google Fonts): #171310/#f2ede7 dark, #f7f3ed/#201a15 light, system-ui — these tokens are load-bearing, not markup added to satisfy an assertion. Also adds the missing apple-touch-icon (static.yml already copies it to the site root, same as the working favicon.svg) and replaces a theme-color of #FAF8F3, which belonged to no palette, with per-scheme values from brand.json.
• test/pages.test.js — the type/space scale assertion is scoped to the generated status page: the SPA computes its own scale, and inlining --fs-N/--sp-N into the shell would satisfy the check with markup nothing reads. The landing metric and version assertions soften from "must be present" to "must be correct if present", so they still bite on a regression. Color and font-stack parity stay enforced on both surfaces.
• New: jsDelivr pin-integrity test — static.yml never deploys landing/assets/, so the live site depends entirely on those pinned CDN references, and nothing checked them. A typo'd chunk name 404s the whole page on a green build. Asserts a full 40-char SHA and that each pinned file exists on disk. Deliberately not == HEAD, which would fail on every unrelated commit.
• scripts/build-pages.mjs — the status page footer claimed "same design tokens as the landing page". That is now true of colors and fonts only; corrected in both the footer string and the module comment.

Known debt (not addressed here, by design)

• landing/assets/c-*.js hardcode forgekit v0.27.0 while package.json is 0.27.3.
• The SPA's source is not in this repo — only its minified output under landing/assets/. That is why recent commits hand-edit minified chunks, and why the stale version can't be corrected properly from here.

Committing the landing source is the real fix for both. Hand-patching a build artifact to make a test pass would be worse than the drift it hides, so this PR leaves it visible and documented in the test comment.

Checklist

• npm test passes — 1073 pass / 0 fail (was 1066 / 6)
• npm run check passes (Biome lint + format) — 10 warnings / 4 infos, byte-identical to the pre-change baseline, all in untouched files
• New public functions have a test — no new public functions; one new test added
• Conventional commit message (fix:)
• CHANGELOG.md updated under ## [Unreleased]
• No new runtime dependency — zero-dependency policy intact
• Substrate/docs updated if this changes forge substrate, forge impact, router/gate, or MCP substrate tools — n/a, none touched

Risk & rollback

• Risk level: low. Changes are confined to a test file, a static HTML shell, and two comment/footer strings. No src/ runtime code is touched, so no shipped behavior changes. The one user-visible change is the landing page's pre-hydration paint, which is strictly an improvement over a white flash.
• Rollback plan: git revert this commit. CI returns to its current red state; nothing else regresses. The landing page reverts to painting white before hydration.

Extra checks

• npm run typecheck passes
• Input validated at boundaries; errors handled (no swallowing) — n/a, no I/O boundaries added
• Authorization/ownership checked — n/a, no access control touched
• Logs contain no secrets/PII — n/a, no logging added
• If AI-assisted: verified — the failure was reproduced locally before any edit, the full gate re-run after, and the critical CSS confirmed load-bearing in a real browser with the network blocked rather than assumed from the markup

---

Generated by Claude Code