fix(colors): sync variants for RAW variable references

[Jan-CoreBunch]

What

RAW colors that reference another color, such as --light: var(--bg-body), now generate transparencies, shades and tints from the current source value. Changing a shade/tint count updates the generated swatches and stored count together, and changing the referenced color refreshes automatic swatches while retaining manual edits.

For example, after changing --bg-body from purple to pink, --light-80 and automatic --light-d-* / --light-l-* variants now follow pink instead of retaining purple.

Why

Transparency generation read a global variable snapshot populated by Preview CSS, which could be missing or stale. Shade/tint generation also received unresolved var(...) values; an empty generation result left old swatches in place while storing a zero count, separate from the counter shown in the UI.

The shared generator and WordPress/Figma-to-WordPress synchronization now receive the current preset variables directly. The editor subscribes to source-color changes, and the counters use the stored color state.

Compatibility and saved colors

• Preserve existing color IDs, variant names, and the underlying shade/tint interpolation.
• Add optional isCustom metadata to shade/tint entries. Manual edits remain fixed; Reset returns a swatch to automatic generation.
• On load, repair known automatic RAW-reference swatches. Older entries without edit history remain unchanged rather than being guessed to be automatic. A stale legacy swatch can be reset individually, then saved.
• Preserve RAW declarations supplied by a theme or custom stylesheet, including their saved variants. Unresolvable or circular references do not produce fallback black transparencies.
• Keep existing site CSS until the normal save/regeneration flow. Document the optional metadata and upgrade behavior in the changelog and developer docs.

CI dependency compatibility

The critical dependency audit also blocked this branch before compilation. Match the existing fixes in #45 and #46 by pinning proxy-addr to 2.0.8 and shell-quote to 1.11.0, and pin handlebars to 4.7.10 for the additional findings now reported through ts-jest (Handlebars advisory, second Handlebars advisory). These are build/test dependencies; the audit threshold is unchanged.

Only those three dependency resolutions change. Regenerating the lockfile also aligns workspace metadata with the existing 2.0.2 package manifests. Identical dependency pins can merge with the other fixes; this PR does not require either product fix.

Verification

• bun run test:www: 27 suites / 186 tests passed, including existing default/prefixed CSS expectations.
• Web, WordPress and Figma production builds passed, including TypeScript checks. The WordPress build used APP_ENV=production in the process environment to preserve the local development configuration.
• WordPress PHPUnit: 45 tests / 94 assertions passed.
• With CI's Bun 1.3.11, the updated frozen lockfile installs successfully, bun audit --audit-level=critical passes, all 186 web/shared-core tests pass, and the Figma and Gutenberg blocks builds pass.
• Read-only Biome check on all 22 changed TypeScript files and git diff --check passed.
• Manually exercised the local Core Framework editor: source-color changes, independent shade/tint counts, custom swatch preservation, Reset, and exported transparency values.
• Reviewed all seven open PRs for overlap. The source changes merge cleanly with fix(figma): stop stuck saves and sync prefixed names to builders #39 and fix(www): make embed view-only and save acknowledgement reliable #41; an isolated combination with fix(figma): stop stuck saves and sync prefixed names to builders #39, fix(www): make embed view-only and save acknowledgement reliable #41 and fix(figma): persist local projects across plugin restarts #45 passed 31 suites / 206 tests.

The normal boundary scan hits the existing Windows separator mismatch in the allowlist for packages/wp/wp/Config/Setup.php. All source and built-output checks passed with separators normalized in memory; the scanner and allowlist are unchanged.

Docker was not running, so the disposable WordPress end-to-end harness was not run locally. The full GitHub CI run passed at commit b2ca84c, including the critical dependency audit, all builds and typechecks, web tests, PHP tests, and WordPress E2E. Bricks/Oxygen builder UI and Figma Desktop save flows were not rerun for this change.

Reproduction / review

1. Set --bg-body to a literal color and --light to RAW var(--bg-body).
2. Enable transparency, shades and tints for --light; change the shade count from 4 to 7 while keeping 4 tints.
3. Change --bg-body and check that automatic variants follow it and --light-80 uses the new color.
4. Edit one swatch manually, change the source again, and confirm the edited swatch stays fixed. Reset it and confirm it follows subsequent source changes.