fix(convert): two color names fall through to grey, and nothing checked (#872)

* fix(convert): two color names fall through to grey, and nothing checked

resolve_opencode_color() maps a name it does not recognise to #6B7280 and
says nothing about it. Four agents ask for a name it has never known:

  engineering/engineering-minimal-change-engineer.md   slate
  specialized/operations-manager.md                    slate
  gis/gis-technical-consultant.md                      navy
  specialized/chief-financial-officer.md               navy

All four render grey in the OpenCode integration, which reads as a
deliberate grey rather than a miss — and some agents do choose grey, so
there was nothing to notice.

`slate` and `navy` are now in the map. Values follow the CSS named color
where one exists (navy -> #000080, matching how teal already works) and
Tailwind's 500 shade otherwise (slate -> #64748B, matching gray).

Adding two names does not stop the next one, so two checks now cover it:

  - lint-agents.sh rejects a color that is neither #RRGGBB nor a name the
    converter knows, and prints the names it knows. The list is read out
    of resolve_opencode_color() rather than copied, so it cannot drift
    from the map that does the work. This runs on changed files in agent
    PRs, which is where a new color arrives.

  - test-convert-outputs.sh fails when an opencode output is #6B7280 and
    the source did not ask for grey. Grey stays a legitimate choice; the
    check is "grey only when the source said so".

CONTRIBUTING now says which color values actually work, since the template
just said `colorname or "#hexcode"`.

Verified: all 279 agents pass the new lint rule, and no opencode output
falls through to grey by accident.

* ci(lint): run the whole roster when the linter itself changes

The lint job scopes itself to the agent files a PR touched, which is right
for an agent PR and wrong for a rule change. A new rule lands without ever
having run against the other 278 agents — it either breaks a division
nobody edited or quietly does nothing, and either way CI is silent.

The colour check in the previous commit is the case in point: it changes
scripts/, so the lint workflow's path filter did not even fire, and the
rule would have merged without CI looking at a single agent.

Adds a lint-all job that runs the full-roster lint when scripts/
lint-agents.sh, convert.sh, or lib.sh is part of the diff, and says why it
is skipping when they are not. Those three paths are in the workflow's
trigger list now so the job can fire at all.

.github/workflows/lint-agents.yml

@@ -21,6 +21,12 @@ on:
       - "support/**"
       - "spatial-computing/**"
       - "specialized/**"
+      # Changing the linter itself has to run it. Without these the whole-roster
+      # job below never fires, and a new rule ships untested: the color check
+      # went in this way and nothing in CI had ever looked at a color value.
+      - "scripts/lint-agents.sh"
+      - "scripts/convert.sh"
+      - "scripts/lib.sh"
 
 jobs:
   lint:
@@ -65,3 +71,36 @@ jobs:
         run: |
           chmod +x scripts/check-agent-originality.sh
           ./scripts/check-agent-originality.sh $CHANGED_FILES
+
+  lint-all:
+    name: Whole roster, when the linter changes
+    runs-on: ubuntu-latest
+    # The job above lints the agents a PR touched, which is the right scope for
+    # an agent PR and the wrong one for a rule change: a new rule has to run
+    # against every agent before it lands, or it either breaks a division nobody
+    # edited or quietly does nothing.
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Did the linter or the color map change?
+        id: rules
+        run: |
+          RULES="scripts/lint-agents.sh scripts/convert.sh scripts/lib.sh"
+          CHANGED=$(git diff --name-only --diff-filter=ACMR \
+            "origin/${{ github.base_ref }}...HEAD" -- $RULES)
+          if [ -n "$CHANGED" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "Linting the whole roster because these changed:"
+            echo "$CHANGED"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "Linter unchanged - the changed-files job is the right scope here."
+          fi
+
+      - name: Lint every agent in the roster
+        if: steps.rules.outputs.changed == 'true'
+        run: |
+          chmod +x scripts/lint-agents.sh
+          ./scripts/lint-agents.sh