test(ci): 第2刀a codegen 漂移检查(token 单源不漂移)

支柱 2(契约单源)守门:
- ci/check-codegen-drift.sh：重生成 pangolin_tokens.gen.dart,与已提交版本
  不一致即失败(改了 CSS 真相源没重生成,或手改了生成物 *.gen.dart)
- ci.yml：新增 codegen-drift job(node:20 镜像,含 git/bash)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -91,3 +91,20 @@ jobs:
 
       - name: scan server Go runtime SQL for MySQL-specific constructs
         run: bash ci/scan-portable-sql.sh
+
+  # ── Job 6: Codegen Drift (支柱 2:token 单源不漂移)──────────────────────
+  # 重新生成 client/lib/pangolin_tokens.gen.dart,与已提交版本不一致即失败
+  # (改了 design/colors_and_type.css 没重生成,或手改了生成物)。
+  codegen-drift:
+    name: Codegen Drift — token 生成物未漂移
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: regenerate flutter tokens & assert no drift
+        run: |
+          docker run --rm \
+            -v "$PWD:/repo" -w /repo \
+            node:20 \
+            bash ci/check-codegen-drift.sh