Per review on #7009: the contrast check was warn-only and opt-in, so it would
never catch regressions. Enforce it here (the follow-up PR):
- theme-lint.mjs `contrast` mode now exits non-zero on any sub-floor pair
- wired into `task frontend:lint:colors` (runs in the blocking lint gate)
- fixed the two failing pairs: --c-text-subtle on dark/portal-dark surfaces
(3.36/3.67 → 4.74/5.18) by adding --p-zinc-250 and pointing dark subtle at it
All text-on-surface / on-primary pairs now clear WCAG AA per theme.