v1.24.0 — kit-scoped governance (design-token writes)

Extends the SiteAgent governance bridge (snapshot-before-write + rollback, live for page writes since v1.17) to design-token writes — the winning-plan P2 'kit/repo-scoped write governance' item, plank 1.

The system-kit writers (replace-system-colors/replace-system-typography), the global-palette writers (update-global-colors/update-global-typography), and the v4 Variables writers (create/edit/delete/restore-variable) act on the active kit post, not a page, so they never reached the page write-site and had no reversal safety. Now they do.

How

• Each write tool declares meta.governance.scope = 'kit'. The design-token write sites call before_kit_write() right before mutating the kit — the same lazy, write-site pattern page writes use — which snapshots the kit's design-token meta (_elementor_page_settings, _elementor_global_variables) via SiteAgent's snapshot_meta; run_governed() rolls the kit back on failure. A first-write create is fully reverted (SiteAgent's restore deletes keys absent at capture).
• Snapshot strictly after validation — every executor validates (existence, size-token-needs-Pro, already-active no-op, per-slot hex) before the snapshot, so a rejected op never snapshots and a failed run never reverts a concurrent, unrelated kit change. Tombstone normalization (itself a kit write) runs under the snapshot.
• Fail-closed: no active kit / snapshot failure → governance_snapshot_failed, the tool never runs. Grants (opt-in) checked before the snapshot. No render check (a kit affects the whole site).

Scope (verified against Elementor 4.1.4): system-kit + palette + variables live in kit-post meta (covered). Global classes are a separate Elementor CPT → plank 2. Interactions are page-data → already page-governed.

Suite green (705). No page-write behavior change.