feat(themes): #62 whole-swap CSS self-containment CI gate

Add tools/check-theme-wholeswap.py and checks.theme-wholeswap: every
themes/*/waybar.css must @define-color each @name it references (raw
readFile, no palette prepend — neon-glass class), and every preset needs
preview.png + non-empty backgrounds/. README: four waybar.css themes
(drop quarantined neon-glass). Close #62.

Verified: V0 (script + negative fixture + checks.theme-wholeswap + flake check --no-build).

flake.nix

@@ -155,6 +155,17 @@
               touch $out
             '';
 
+          # Whole-swap waybar.css is read raw (no palette prepend) — every
+          # @color it references must be @define-color'd in the same file
+          # (neon-glass shipped zero defines; BACKLOG #62). Also gate
+          # preview.png + non-empty backgrounds/ per preset.
+          theme-wholeswap = pkgs.runCommand "nomarchy-theme-wholeswap"
+            { nativeBuildInputs = [ pkgs.python3 ]; }
+            ''
+              python3 ${./tools/check-theme-wholeswap.py} ${./themes}
+              touch $out
+            '';
+
           # The README option tables must track the live `nomarchy.*`
           # surface. The surface is walked at eval time from the four
           # option-declaring modules (their lazy `config` halves stay