Summary

• Rewrites `packages/ui/src/styles/theme.css` from scratch against PawWork STANDARDS L8-L42: warm neutrals, brand orange `#ff5910` ≤10% accent, 13px dense base, system-font stack only.
• Fixes a latent dark-mode bug: upstream `@media`-only approach meant the Settings toggle had no effect on most tokens. Now `[data-color-scheme="dark"]` is the authoritative selector; `@media` block is a first-paint mirror only.
• Rewrites `packages/ui/src/theme/themes/pawwork.json` to STANDARDS values with the new token names.
• Rebuilds `packages/ui/script/colors.txt` (104 token names including legacy compat aliases) and regenerates `packages/ui/src/styles/tailwind/colors.css`.
• Renames 50+ upstream token names to STANDARDS names across 144 component files in `packages/ui/src` and `packages/app/src`.
• Fixes first-paint HTML entry files: updates `packages/app/index.html` and `packages/desktop-electron/src/renderer/{index,loading}.html` to use `var(--bg-base)` and syncs `theme-color` meta tag values.
• Adds legacy compat token aliases (`button-brand-*`, `icon-success-base`, `icon-info-base`, `icon-on-interactive-base`) to the UNREGULATED section so existing consumers remain styled.
• Fixes Tailwind shadow bridge aliases in `tailwind/index.css`: maps `shadow-xs` → `--shadow-raised`, `shadow-md` → `--shadow-floating`, `shadow-xs-border` → `--shadow-xs-border-base`.
• Adds a Bun parity test (128 assertions) that enforces sync between `theme.css` and `pawwork.json`, including dark-completeness and `@media` mirror checks.
• Adds a Bun undefined-token scan test that asserts every regulated `var(--xxx)` reference resolves to a definition in `theme.css`.
• Adds `.gitattributes` carve-out entries with `merge=pawwork-keep-ours` driver plus `packages/ui/script/verify-merge-driver.sh`.

Why

PawWork's UI must permanently diverge from upstream opencode's cool-gray / Catppuccin token system. This slice establishes the token foundation that all subsequent component slices (#2–#11) will build on.

Related Issue

Refs #440 (umbrella). This PR is slice #1 of eleven.

Human Review Status

Pending. A human should make the final merge decision after reviewing the final diff and verification evidence.

Review Focus

• Token rename correctness: 50+ renames across 144 files — the undefined-tokens.test.ts scan verifies no regulated var(--xxx) is left dangling.
• Dark-mode selector strategy: [data-color-scheme="dark"] is authoritative; @media block is mirror-only — confirm theme-parity.test.ts enforces exact value sync.
• Compat alias wiring: five legacy tokens in the UNREGULATED section resolve to new canonical tokens — verify buttons and icon components render correctly.
• .gitattributes carve-out: three HTML entry files newly added — confirm merge driver covers all intended paths.

Changed-file boundary check

All modified files are within the permanent carve-out paths declared in AGENTS.md and enforced in `.gitattributes`:

• `packages/ui/**` ✓
• `packages/app/src/app.tsx` ✓
• `packages/app/src/components/**` ✓
• `packages/app/src/context/**` ✓
• `packages/app/src/index.css` ✓
• `packages/app/src/pages/**` ✓
• `packages/app/src/styles/**` ✓ (none touched this slice)
• `packages/app/src/theme/**` ✓ (none touched this slice)
• `packages/app/src/i18n/**` ✓ (none touched this slice)
• `packages/app/src/utils/**` ✓
• `packages/app/index.html` ✓ (now in carve-out)
• `packages/desktop-electron/src/renderer/index.html` ✓ (now in carve-out)
• `packages/desktop-electron/src/renderer/loading.html` ✓ (now in carve-out)

No `packages/opencode/**` or other out-of-scope paths were touched.

Merge driver setup

The `.gitattributes` carve-out uses a named driver that must be registered once per clone:

```bash
git config merge.pawwork-keep-ours.driver "true"
```

Verify before any upstream sync:

```bash
bash packages/ui/script/verify-merge-driver.sh
```

Without the driver, git falls back to three-way merge on the carve-out paths. The attribute entry is inert without registration.

How To Verify

```text
typecheck (packages/ui): tsgo --noEmit → 0 errors
typecheck (packages/app): tsgo -b → 0 errors

parity test: bun --cwd packages/ui run test test/theme-parity.test.ts
128 pass, 0 fail
Covers: light root, dark [data-color-scheme="dark"] overrides, dark completeness
(all light regulated tokens must have dark override or be in SAME_IN_DARK),
@media mirror exact-match against attribute dark block, extra/missing key
detection, value normalization, parser unit fixtures (extractBlock/parseDeclarations/normalize)

undefined-token scan: bun --cwd packages/ui run test test/undefined-tokens.test.ts
2 pass, 0 fail
Scans all CSS/TS/TSX var(--xxx) for regulated prefixes; asserts each resolves
to theme.css or known-gap allowlist (pierre diffs API, @property-registered lengths)

merge driver verify: bash packages/ui/script/verify-merge-driver.sh
✓ merge driver 'pawwork-keep-ours' is registered (driver = 'true')

note: session-diff.test.ts 2 failures are pre-existing; not caused by this PR
(session-diff.ts/test.ts untouched, confirmed via git diff)
```

Screenshots

Light mode

Dark mode

Token rename key mappings

Old name → New name (abbreviated):

Legacy compat aliases (kept for existing consumers, UNREGULATED):

Known issues (scoped to later slices)

• button/icon-button state tokens (hover/active/disabled) have incomplete differentiation in some variants — tracked for slice feat: PawWork persona layer + i18n fixes + error page GitHub redirect #4.
• list search focus-visible ring is missing — tracked for slice fix(config): harden scoped dependency loading #6.
• shadow/ring/blend-mode in `--color-*` Tailwind namespace: `tailwind.ts` maps all tokens to `--color-*`; separating color vs shadow namespaces requires a Tailwind config refactor — tracked as slice feat: split desktop panel and thread locale into skills #2 prerequisite.
• old utility class residual scan (e.g. `text-text-`, `bg-background-`): targeted allowlist-based scan for pre-rename class names — tracked as P3 follow-up.

Risk Notes

This PR combines four categories of change with different risk profiles:

1. Token rename across 144 files (~1800 ins / ~2300 del): mechanical find-and-replace; no logic changed. Risk: any missed reference silently produces an unstyled element — mitigated by the `undefined-tokens.test.ts` `var(--*)` scan.
2. Theme contract changes (`theme.css`, `pawwork.json`, `colors.txt`): changes the actual color/shadow values rendered in the UI. Risk: visual regression — mitigated by parity test, screenshot comparison, and smoke test.
3. Generated artifacts (`tailwind/colors.css`): regenerated from `colors.txt`; a stale file would misalign Tailwind utilities with runtime tokens. Risk: `bg-surface-sunken` utility would resolve to the wrong color — mitigated by manual regen + post-regen review; a generation consistency test (colors.txt ↔ colors.css) is planned for slice feat: split desktop panel and thread locale into skills #2.
4. Merge-driver carve-out (`.gitattributes`, `verify-merge-driver.sh`): establishes upstream sync boundary. Risk: mis-configured driver silently loses PawWork customizations on upstream sync — mitigated by the verify script and PR documentation.

Component-local tokens (`shell-`, `diffs-`, `tool-motion-`, `h-`, `kb-*`, `radius-xs`) were intentionally left untouched. Unregulated tokens (avatar 12, markdown 14, syntax 19, agent-icon 4, surface-diff-hidden 5) preserved at original values.

Checklist

• Human review status is stated above as pending, approved, or not required
• I linked the related issue, or stated why there is no issue
• This PR has type, scope, and priority labels, or I requested maintainer labeling
• I described the review focus and any meaningful risks
• I listed the relevant verification steps and the key result for each
• I did not introduce unrelated refactors, dependencies, generated files, or file changes beyond the stated scope
• I manually checked visible UI or copy changes when needed, with screenshots or recordings
• I considered macOS and Windows impact for desktop, packaging, updater, signing, paths, shell, or permissions changes
• I called out docs, release notes, dependencies, permissions, credentials, deletion behavior, generated content, or local file changes when relevant
• I reviewed the final diff for unrelated changes and suspicious dependency changes
• I am targeting `dev`, and my PR title and commit messages use Conventional Commits in English