Add portable token artifact validation

[changeroa]

Purpose

Add a restricted, reproducible token adapter and prove generated artifact integrity before any reference profile consumes it.

Scope

• Pin Node 22 and Style Dictionary 5.5.0.
• Generate deterministic CSS and a source/output integrity manifest.
• Validate counts, hashes, declarations, warnings, adapter identity, aliases, and exact canonical rebuild equivalence.
• Reject unsupported token shapes, unsafe paths, cyclic/dangling/type-mismatched aliases, missing output, scaffold success, and jointly forged CSS/manifest data.

Non-goals

No profiles, themes, consumer migration, browser UI, components, or Layout corpus changes.

Verification

• Adapter harness: 31/31.
• Real build: 6 tokens to 6 declarations, zero warnings.
• Generated regeneration: zero diff.
• Full inherited workflow and independent adversarial verification: PASS.

Commands:

node scripts/test-reference-adapters.mjs --json
node scripts/validate-reference-artifacts.mjs --manifest consumer-reference/generated/manifest.json --json

Durable evidence: .omo/evidence/consumer-reference-roadmap-implementation/pr2/.

Stack and rollback

PR1 is already merged into main as #20. This PR is the first remaining upstream stack layer and should merge before roadmap 03. Revert 2f166cb to remove the adapter, generated CSS/manifest, lockfile, and validation as one atomic unit.

[changeroa]

ULW triage: changes requested for standalone merge

Five independent review lanes plus a full local workflow run were completed at exact head 2f166cb3244f4d5ef398e7b89ea61003eee136af.

Lane results: goal PASS; hands-on QA FAIL; code quality FAIL; security FAIL (MEDIUM); context mining FAIL. The official workflow, generated-drift check, and existing 31-case adapter harness all pass, but additional adversarial cases expose blockers the current suite misses:

1. scripts/validate-reference-artifacts.mjs:50-53 accepts parsed null into the manifest block and crashes with an uncaught TypeError instead of returning a named JSON finding.
2. scripts/validate-reference-artifacts.mjs:64-82 uses existsSync before unguarded reads; directory-valued sourceFile/outputFile paths reproducibly crash with EISDIR and no JSON.
3. scripts/build-reference-artifacts.mjs:53-55,109-110 accepts unrestricted paths and follows symlinks; a non-destructive probe overwrote an external symlink target.
4. scripts/validate-reference-artifacts.mjs:97-104 rebuilds an expected manifest but compares only CSS, allowing noncanonical manifest structure/paths to validate successfully.
5. consumer-reference/schema/portable-tokens.schema.json:62-95 and runtime validation disagree on empty groups and $type/$value pairing; existing parity tests do not cover this.

Context check confirms these are known deferred gaps: PR #26 commit d7261db adds strict duplicate-key parsing and contained regular non-symlink path checks, while 67ff913 adds real-pipe JSON integrity handling. Therefore #21 should not be treated as a safe standalone endpoint. It may be reconsidered only after the complete #21→#26 stack has independently passed cumulative review and can be merged sequentially without leaving the repository at this layer.

Reproduction summary: null/source-directory/output-directory cases each reproduced twice at Node v22.23.1; canonical manifest validation remained exit 0. No source files were modified and the detached review worktree was clean after cleanup.