Add adversarial design reference profiles

[changeroa]

Purpose

Add two governed-local, deliberately different reference profiles that exercise the shared Layout and token contracts without establishing a default design system.

Scope

• Add editorial and terminal profile, token, and local-foundation records.
• Require experimental, example-only, non-default status and explicit selection/reset assumptions.
• Prove profile identity, tokens, and foundations remain distinct.
• Add documentation-only external-adaptation routing with zero durable adopter records.

Non-goals

No canonical/default profile, production or independent-adopter claim, shared visual default, component/runtime record, Playwright code, or Layout corpus change.

Verification

• Profile harness: 26/26.
• Consumer/domain/IA suites and official workflow: PASS.
• Both token sources build through Style Dictionary 5.5.0 with six declarations and zero warnings.

node scripts/test-validate-reference-profiles.mjs --json
node scripts/validate-consumer-reference.mjs --json
node scripts/validate-domains.mjs --json

Durable evidence: .omo/evidence/consumer-reference-roadmap-implementation/pr3/.

Stack and rollback

Base is codex/roadmap-02-token-artifacts; merge only after the token PR. Revert 620d764 to remove this layer. No shared/generated Layout artifact depends on these profiles.

[changeroa]

ULW triage: changes requested

Review completed at exact head 620d764e140da15f35830aadb27f3272aa2b52ed with five terminal lanes plus the full local workflow. Lane results: goal PASS, hands-on QA PASS, code quality FAIL, safe data/repository boundaries FAIL, context mining FAIL. The first security attempt was policy-filtered and was replaced by a bounded read-only safety lane.

The checked-in cases are healthy: profile harness 26/26, consumer 80/80, domain 30/30, IA 13/13, both Style Dictionary 5.5.0 builds at six declarations/zero warnings, full inherited workflow, augmented malformed/routing cases, and drift detection all pass. However, review found false-success paths outside those fixtures:

1. scripts/reference-profile-contract.mjs:92-111 proves token/foundation distinctness with raw-file hashes. Semantically identical token JSON with only formatting/key-order differences passes as “distinct”; this was reproduced and still passes at PR Harden cumulative reference evidence contracts #26 head.
2. scripts/consumer-reference-schema.mjs:84-90 does not implement the schema's conditional profile requirements, while supplemental validation is path-gated at validate-consumer-reference.mjs:167-171; incomplete profile_kind records can pass runtime validation.
3. Governed profiles do not require their handoff record to identify their own canonical path, so one profile can point at the other and still validate.
4. Portable-token validation does not prevent flattened Style Dictionary output-name collisions; a crafted pair passed the profile contract but failed the required pinned adapter build.
5. Default discovery hard-codes two profiles, so another tracked governed-local/<name>/profile.json can evade default CI despite the governed family declaration.
6. Foundation validation (reference-profile-contract.mjs:83-89) accepts empty/arbitrary bindings and lacks a closed schema/version contract.

Descendant PR #26 does repair path portability, strict duplicate-key JSON, ambiguous CLI values, pipe-safe JSON, profile-hub links, and governance glob scope. It does not repair semantic-equivalence distinctness, so the current stack remains blocked on at least that central claim.

No tracked files were modified by review; the detached worktree is clean after QA cleanup.