chore: storage-value hardening (XSS review) + governance sync

[jpettitt]

Summary

• Storage-time shape checks for decoration values, from the XSS review: every render sink was verified inert (CSSOM property assignment discards invalid values; Lit bindings escape; ha-icon treats icons as lookup keys), so this is defense-in-depth — icon must be prefix:name (DESIGN §4.3 documented this check but it didn't exist), and colors reject characters no CSS color uses (<>{};, quotes, backslash, control chars, url(). 30 new parametrized tests cover hostile payloads (<script>, javascript:, CSS smuggling via ;/escapes/url() and the full legitimate value space (hex, rgb()/hsl(), named, var(--…), color-mix(), custom icon packs).
• release.yml now refuses a tag whose version ≠ manifest.json (frontend package deliberately ungated — semver prerelease format differs from PEP 440).
• Governance sync, all explicitly requested: dropped the unread min_ha_version manifest key (hacs.json is the enforced floor), AGENTS.md gate count 100 → 173, TODO's human-only-files block resolved.

Test plan

• .venv/bin/pytest -q — 173 pass (was 143)
• cd frontend && npm run typecheck — zero errors
• cd frontend && npm test — pass
• cd frontend && npm run build — no bundle drift (no frontend source changes)

Manual / UI verification: n/a — validation + CI + docs; no paint-path change.

Risk

• Tightened validation can drop existing stored rules whose values fail the new checks at next load — logged via the v0.3.1 WARNING. Real-world values are unaffected; the CHANGELOG documents it under Unreleased.
• Workflow edit is release-path only and fails closed (blocks a mismatched publish rather than allowing one).

Docs touched

• README.md
• CHANGELOG.md
• TODO.md
• DESIGN.md
• docs/examples.md

🤖 Generated with Claude Code