feat(manager): worlds — the parts of a life, and the faces in them - #212

`manager-theme.css` sets the rule that `--w-ok` / `--w-warn` / `--w-danger`
are the only colours that mean anything. A world colour is the third
categorical set, and the first one in this console chosen by a **person** —
which is exactly what makes it worth asserting rather than eyeballing.

Given a free-form hex from a holder, nothing could keep a decorative choice
out of the semantic channel: someone names a world "Work", picks red, and
every card in it reads as an alarm with no way to discover why. A closed set
of eight makes that unrepresentable rather than merely discouraged.

`manager-world-colour.test.mts` computes the distance from the values the
stylesheet actually ships — not from a copy kept in the test, which would
pass forever after someone edited the CSS — per theme, because a light world
colour sitting far from the light danger red says nothing about the dark
pair and both ship. Closest legitimate pair is 69.6 (sand vs warn, dark)
against a threshold of 60.

**Verified non-vacuous**: moving `--m-world-clay` to #b03d2d fails the test
with "is 9.0 from --w-danger … a holder picking it would have every card in
that world read as danger".

`WORLD_COLOURS` is typed against the generated `FacetColour` union, so a
ninth colour published in the specification is a compile error here — a
picker missing an option the agent will happily store — rather than a name
this console silently cannot draw. `worldHue` returns a token reference and
never a value, because a component reaching for a hex is correct in exactly
one theme.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>

The console's half of `persona/facet/*`, behind a third view on the persona
pane. A holder who uses this model for a while does not end up with three
faces; they end up with twenty, and a flat list of twenty is a list nobody
reads.

**The delete confirm is the whole screen.** A grouping that looks like a
folder is assumed to behave like one, so the confirm names what *survives*
before what goes: "All 2 faces in it — Acme, LinkedIn — stay exactly as they
are." A holder who believes Delete takes the faces with it will not press
it; one who believes it and is wrong has lost nothing and will never trust
the screen again. There is no cascade on the wire and none is implied —
`worlds-pane.render.test.mts` asserts both the survival sentence and the
absence of any "also delete" copy.

**A face already elsewhere is greyed before the save, not refused after.** A
checkbox that looked available and then failed is a refusal the holder had
no way to anticipate. `worldOfFace` excludes the world being edited, or a
world becomes uneditable the moment it holds anything.

**The refusal is matched on the code, and typed on the class that carries
one.** `placedElsewhere` tests `instanceof RelayTaskError` and `code ===
"persona/facet/put:faceAlreadyPlaced"` — R3.7, never a message. A refusal
whose details are missing or half-typed returns null rather than an empty
list: "0 faces already belong elsewhere" is a claim, and half an answer
about where the holder's faces are is worse than none because the missing
half is invisible.

**The editor opens with the membership it will replace.** A put replaces
both lists, so an editor seeded empty would silently empty a world on an
edit that meant to rename it — and it carries the version it read.

Faces belonging to no world are reported rather than hidden. Most are, before
anyone arranges anything, and a screen listing only arranged faces
under-reports what the holder has.

`task-surface.json` is synced from vta-sdk 0.34.1 — the version published by
VTI#1338, so the snapshot records a surface that exists — and the recorded
coverage moves 198 → 201 in the same commit, which is what that guard asks
for.

Verified on a real build: all three URIs appear in `manager.js` and in no
other bundle, which is both halves of the CI guard.

core 596/596, extension 479/479, `tsc -b` clean.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>