ui: visual redesign — the hash as the design material

Design system for the operator UI (still: one package-shipped stylesheet,
no CDN, no build step, system fonts only):

- Palette: ink blue-black with warm paper-white text; ONE loud color —
  seal amber — reserved for decisions and the typed echo zone; verify
  green and refuse red as outcome colors; hairline borders.
- The hash is the centerpiece: the first 12 characters (the echo zone)
  render in seal amber, the remainder recedes to muted — the operator
  sees exactly which part they are about to type.
- Live echo feedback while typing the 12-hex prefix: character counter,
  match/mismatch coloring. Display-only — nothing is auto-filled, the
  server remains the authority, wrong prefixes still refuse server-side.
- Pending/history cards as dockets with a severity edge: red for
  destructive git actions and recursive deletion, amber for deploys,
  blue for plain git. Monospace uppercase eyebrows carry the action
  types; commands render with a $ prompt marker.
- Evidence timeline with a chain line and per-event seal dots (amber
  seal, green applied, red refusals).
- Quality floor: visible focus rings, 44px touch targets,
  prefers-reduced-motion respected, mobile-first unchanged.

All pinned markup anchors and strings (full-hash structure, CSRF fields,
warning lines, download label) are byte-identical; 321 tests green.

test: fix CI-only moved-remote failure (git default-branch drift), pi…

…n the CI condition locally

Diagnosis (test bug, product unaffected): the repo_with_remote fixture ran
'git init --bare' without pinning the initial branch, so the bare remote's
HEAD followed the environment's init.defaultBranch - 'main' on Apple Git
(compiled-in default, hence green on macOS), 'master' on ubuntu-latest under
the isolated test config. With a master HEAD pointing at a nonexistent ref,
the clone starts on an unborn master, the "someone else" commit becomes a
root commit there, and its push creates refs/heads/master on the remote -
refs/heads/main never moves, the fetch sees no change, h1 == h2. Every
subprocess succeeds, which is why the failure surfaced as the assertion and
only on Ubuntu. Reproduced locally by forcing init.defaultBranch=master;
confirmed the derivation reported the truth (the tracked remote branch
genuinely had not moved), so the moved-remote guarantee was never silently
broken - the foreign commit simply landed elsewhere.

Fix:
- fixture pins the bare remote to -b main and makes the foreign actor
  explicit (clone --branch main, explicit refspec on its push); the
  h1 != h2 assertion is unchanged.
- all test _GIT_ENV dicts now pin the adversarial init.defaultBranch=master
  via GIT_CONFIG_* env, so macOS runs exercise the same condition as CI
  permanently (the full suite is green under it).
- CONTRIBUTING notes the aiosqlite teardown warnings as known cleanup noise
  (a proper fix needs engine.dispose() through many inline helpers; not
  worth the churn now).