fix(dashboard): a11y basics — skip link, toast live region, combobox palette, keyboard-reachable workbench cards; restore canonical link tokens (design audit P3)

[Xore]

Summary

• Payload workbench run cards keep the clickable-<div> design (per docs/design-lab/README.md), but are now keyboard-reachable: role="button", tabIndex={0}, aria-label, aria-expanded, Enter/Space via onKeyDown.
• Toast stack (LiveToasts.tsx) gets role="status" aria-live="polite" aria-atomic="false", a per-toast dismiss button, and hover/focus pauses the 12s auto-dismiss timer (resumes on leave/blur).
• Skip link added as the first focusable element in AppShell, targeting a new id="main" on <main>; reuses the vendored .sr-only class with an inline focus-reveal style (theme.css is vendored, not hand-edited).
• CommandPalette's textarea now exposes role="combobox", aria-expanded, aria-controls, aria-activedescendant; result rows are tabIndex={-1} so the input remains the single tab stop.
• branding/templates/web/apiary-theme.css --apiary-link restored to the canonical tokens (dark #de866b, light #9b4f3a) per branding/tokens.json, replacing the AA-failing blues.

Checked docs/design-lab/README.md (clickable cards not links, no lazy-load, skeleton-first ES panels, one page width, SPA feel) — none of these fixes conflict with it.

Found one more instance of the unfixed clickable-div pattern (Investigate.tsx CardTag, non-href branch) outside this task's scope — filing a separate issue rather than expanding this PR.

Test plan

• npm ci + npm run typecheck (tsc --noEmit) — clean, no errors
• git diff --stat reviewed — only the 5 intended files touched, no lockfile drift
• Manual keyboard pass (Tab to skip link, Tab into workbench cards + Enter/Space, palette arrow+Enter, toast hover-pause) — not run in this environment

[strix-security]

Strix Security Review

No security issues found.

_{Updated for 8668db3.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[strix-security]

Reviewed all five changed files in this accessibility-focused PR. The changes are limited to ARIA attributes, keyboard reachability, toast dismissal timer management, a skip link, and CSS color tokens. No untrusted data reaches any dangerous sink: interpolated values (toast messages, recipe names, palette indices) are rendered through React's automatic output/attribute escaping, and no user-controlled URL, HTML, SQL, file path, or exec sink is introduced. No security issues found.

---

Reviewed by Strix
_{Configure security review settings}

[strix-security]

This workspace has reached the limit of 50 included PR reviews during your trial. Upgrade to continue receiving PR security reviews.

So far, Strix has reviewed 36 pull requests and surfaced 2 security issues across this workspace.

[Xore]

CodeQL failure root-caused: paths-ignore entry for docs/design-lab was described in comments but never added as a live list item, so CodeQL kept scanning the local-only compare.html harness (documentation-artifact noise, same class as the ghost-vendor exclusion).

Round-2 attempted encodeURI() at the iframe sinks was rejected on review (double-encodes already-percent-encoded safePath output %→%25); reverted.

Now: real docs/design-lab paths-ignore entry added; the two DOM-text alerts on compare.html are excluded as documentation artifacts.

CI re-running — expected CodeQL green.

[Xore]

Removed stray Co-Authored-By trailer from the ci(codeql) commit; content unchanged. CI re-running.