fix(swaync): palette-safe pairings — text was invisible on summer-day (item 25)

Palette roles aren't uniform: summer-day and flexoki-light use subtext
as text-ON-surface (== base) and surface as a dark chip (== text), so
swaync's @subtext-on-@base body text and @surface/@text buttons were
self-colored (caught on the Latitude).

- body/summary: @text on @base — the one text pairing that passes in
  every palette (survey: worst WCAG ratio 5.18 across all 21 themes;
  subtext/base bottomed at 1.00 twice, muted/base at 1.27).
- hover rows + widget-title buttons: alpha(@text, 0.1) tints —
  contrast by construction; subtext/surface defines dropped.
- NEW checks.theme-contrast (tools/check-theme-contrast.py): asserts
  the hex-on-hex text pairings across themes/*.json, cheap (no VM).

The audit also found the generated waybar/rofi CSS shares the bug
class, live on flexoki-light (no whole-swap) → BACKLOG item 27.

Verified: V0; V1 (checks.theme-contrast builds green, 21 themes;
rendered services.swaync.style has zero @subtext/@surface). Honesty:
NOT visually verified — V3 queued (notify-send on summer-day).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -135,6 +135,18 @@
           downstream-template-home =
             downstream.homeConfigurations.me.activationPackage;
 
+          # Every hex-on-hex text pairing the generated swaync CSS uses
+          # must contrast in EVERY palette — summer-day's body text was
+          # invisible on hardware (item 25: subtext==base there). Cheap
+          # (no VM); extend the script's PAIRINGS as more generated
+          # surfaces move to palette-safe roles (item 27: waybar/rofi).
+          theme-contrast = pkgs.runCommand "nomarchy-theme-contrast"
+            { nativeBuildInputs = [ pkgs.python3 ]; }
+            ''
+              python3 ${./tools/check-theme-contrast.py} ${./themes}
+              touch $out
+            '';
+
           # Config-level VM assertions for the nomarchy.hardware.* toggles —
           # what they SET (kernel cmdline, fprintd, PAM). Real hardware
           # behaviour (firmware/driver/device) needs bare metal and is out of