fix(gtk): scope the #98 button-label pin to dialogs — it was repainting the bar

The bare `button, button label` selectors in the #98 safety net load
into every GTK3 process, including Waybar, and a rule matching the label
node outranks the color waybar.css inherits onto `#workspaces button` —
so workspace digits always rendered the gtk.css text color captured at
bar start, never the theme's @muted dots / @base-on-accent active pill
(the pair check-theme-contrast.py gates). With the bar never restarting
on switch (previous commit) the pin also went stale: all three 2026-07-18
screenshots carried kiln-clay's @text #39302A across three dark themes.
Scoped the enabled+disabled pins to the dialog selectors #98 actually
targeted; forcing adw-gtk3-dark remains the primary #98 fix, and the
sheet's own bare `label` rule sets only caret-color, so inheritance
carries the bar colors again.

Verified live on Newton (V3-grade): under the scoped gtk.css, boreal
renders the designed digits — @base #21272F on the @accent pill, @muted
#5E6A78 inactives — pixel-sampled from a bar spawned on a headless
output. V1: HM generation builds; bare selectors absent from the built
gtk.css, dialog-scoped ones present. Journal, hardware-queue (deploy
round-trip) and ROADMAP follow-up ride along.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -1947,6 +1947,12 @@ Design/decision records and a running log of shipped work (items marked
   unsupervised/custom bars; `reload_style_on_change` stays for manual
   `home-update` restyles. VM-verified on the headless software-GL
   desktop: SIGKILL → new pid; clean kill → respawn; SIGUSR2 → alive.
+  **Follow-up (2026-07-19):** a later waybar package wrap renamed the
+  comm to `.waybar-wrapped`, silently no-oping every `pkill -x waybar`
+  (switches stopped touching the bar → the stale workspace-digit-color
+  bug), while the *unanchored* RTMIN pokes substring-matched the
+  supervisor's `nomarchy-waybar` comm and killed it. All pokes now use
+  `-x 'waybar|\.waybar-wrapped'`.
 - ✓ **`sys-rebuild`** (Latitude QA request): the no-update twin of
   `sys-update` — snapshot-first system rebuild against the *current*
   lock, for config-only changes; `home-update` was already lock-free.