chore(theme): fail token build on unresolved tokenRef

[robsongajunior]

Summary

Closes the engineering-audit finding: compile-primitives.js / compile-theme.js silently fall through on an unresolved tokenRef — a typo'd token either shipped as a raw path.to.token string in the CSS (primitives) or silently vanished from the output (theme), with no build warning.

• New shared assertResolvedRefs(context, unresolved) in refs.js: throws one aggregated error listing every miss as --var → ref.path.
• All three resolvers now collect misses and assert — compile-primitives.js, compile-theme.js, and resolve.js (same silent class: raw-ref fallback; the audit had only named two).
• build-tokens.mjs drops its private re-implementation of the primitives flatten in favor of the guarded compilePrimitivesVars().
• Net effect: the token build, prepack (publish), and any import of these modules fail loudly on a bad ref — a typo can never ship.

Verification

• Clean tree: build:tokens green and dist/v4 output byte-identical to the pre-change baseline (the guard is a pure no-op on valid data); build:dts (publish-path vue-tsc emit) green.
• Three deliberate-typo tests, one per resolver, each failed the build with the exact --var → ref in the message (e.g. [theme] 2 unresolved tokenRef(s) in semantic theme tokens: [light] --primary → brand.primary.primary-999 …), each reverted.

Notes — the guard immediately found real rot

semantic/colors.js carries 4 pre-existing dangling refs: --background-backdrop → primitives.alpha.neutral.25 and --background-primary-mask → primitives.alpha.brand.primary.65 (light + dark) — alpha has no neutral/brand shades. They live in the dead css-vars.js/resolve.js path: zero callers in the monorepo, not in theme's exports map, and the shipped CSS gets those variables from the healthy compile-theme path — production is unaffected. This PR deliberately does not guess data fixes: createCssVars() now throws with that exact list if anyone revives the API. Follow-up decision: point the refs at real alpha shades (needs design input) or delete the unreferenced css-vars.js/resolve.js pair.

• chore type → no release (dist output unchanged; the guard matters at build time).
• No new dependencies; no public API changes.