Publish the theme catalog contract

[konojunya]

Background

The render toolchain needs one public theme, icon, and deterministic font-metrics contract before the core catalog and engine integration can be implemented. Native Rust and browser consumers must identify and consume the same catalog without host I/O.

Implementation

• define the draft 1.0 JSON Schema and a complete conformance fixture for theme identity, palettes, typography, every Stack 1.0 node-kind fallback, connector styles, icons, font metrics, and provenance
• add one canonical 0.1.0 source catalog and a deterministic SHA-256 content revision shared by Cargo stack-theme and npm @stack-sh/theme
• expose typed Rust and TypeScript APIs, embedded SVG accessors, schema and metadata artifacts, and coordinated package contents without publishing either package
• validate references, reserved identifiers, distribution permissions, license files, SVG allowlists, and cross-theme icon subjects
• preserve the required baseline check and add Node package gates plus Rust 1.85 tests and Clippy

Testing

• npm ci
• npm run validate
• npm run generate:check
• npm test
• npm run typecheck
• cargo +stable fmt --check
• cargo +stable test --workspace --locked
• cargo +stable clippy --workspace --all-targets --locked -- -D warnings
• RUSTDOCFLAGS=-D\ warnings cargo +stable doc --workspace --no-deps --locked
• cargo +1.85.0 test --workspace --locked
• cargo +1.85.0 clippy --workspace --all-targets --locked -- -D warnings
• npm pack --dry-run --workspace @stack-sh/theme
• cargo +stable package -p stack-theme --locked --allow-dirty

Review focus / concerns

• The source catalog is intentionally empty; default, light, dark, and their reviewed assets belong to the next change before any registry release.
• Please focus on whether integer layout units, fallback references, content-revision semantics, provenance requirements, and the SVG allowlist are sufficiently constrained for both native and WASM consumers.