feat(compose): DaisyColors + KolektivTheme palettes from tokens.json

[LizAinslie]

Adds a Compose Multiplatform module so Kalendee / Blawk can consume Kolektiv colour tokens without vendoring hex.

What

• dev.kolektiv.themes:themes (DaisyColors, KolektivTheme, seven palettes generated from tokens.json)
• Palettes: nord, catppuccin-latte/frappe/macchiato/mocha, kolektiv-light / kolektiv-dark (CSS aliases kolektivcomputer-lig / kolektivcomputer-dark)
• Gradle wrapper + :themes:jvmTest covering hex lockstep and aliases
• Bump @kolektiv/themes to 0.0.1-SNAPSHOT.3

Notes

• Colour-only, same contract as the JS package. Radii / density stay in the consuming app (Blawk metrics, Kalendee pack CSS).
• Brand palettes only. Kalendee product chrome (#090909 / #DF6F00) does not live here — that stays in Blawk's KalendeeColors.
• Until Maven is on repo.yuri.capital, consume via includeBuild("../themes") and substitute dev.kolektiv.themes:themes → project(":themes").
• compose/scripts/generate_palettes.py regenerates Palettes.kt from a tokens.json that includes sRGB hex.

KolektivTheme(KolektivThemes.kolektivDark) {
    val colors = KolektivTheme.colors
}

[LizAinslie]

Publishing landing on this branch

• Maven dev.kolektiv.themes:themes → GitHub Packages + Yuri (maven-releases / maven-snapshots) via :themes:publish
• npm dual: existing Yuri brand-npm + GitHub Packages
• JSR jsr.json + publish-jsr.sh (OIDC or JSR_TOKEN / JSR_AUTH_TOKEN)
• Docs: docs/PUBLISHING.md

publish.yml updated to run Maven + npm + JSR on v* tags (skips unauthenticated targets). release.yml still owns the GitHub Release.

GroupId: still dev.kolektiv.themes to match this PR; org epic prefers computer.kolektiv.* — follow-up migrate.

JSR org setup for Mey: prefer OIDC (link package on jsr.io to this repo) — no org secret. Optional org secret JSR_TOKEN or JSR_AUTH_TOKEN if not using OIDC.

[LizAinslie]

Status before you’re back

TypeScript path verified locally on feat/compose-themes:

• pnpm typecheck ✅
• pnpm test ✅ (7/7)
• pnpm build:packages ✅ (7 themes × 20 tokens)
• pnpm pack produces @kolektiv/themes tarball with dist/, css, tokens

Publishing wiring on this PR:

Target	Status
Maven → GH Packages + Yuri	scripts + compose maven-publish
npm → Yuri brand-npm + GH Packages	publish-npm.sh
JSR	OIDC-only (id-token: write); no org JSR_TOKEN — link package on jsr.io for trusted publishing
publish.yml on branch	unchanged (OAuth token lacks workflow scope)

You need to paste once: copy docs/workflow-publish.yml.example over .github/workflows/publish.yml (or push with a PAT that has workflow). That example includes Maven + dual npm + JSR OIDC + verify step.

Org setup when ready: claim @kolektiv on jsr.io, enable GitHub Actions trusted publishing for KolektivComputer/themes. Secrets: YURI_CAPITAL_REPO_USERNAME / YURI_CAPITAL_REPO_PASSWORD only for Yuri; GITHUB_TOKEN covers GH Packages.

No Java on the bot box — didn’t run :themes:jvmTest here; CI should still cover Compose when the workflow runs.