Run goldens rebaseline

The only sanctioned way to re-accept many goldens at once (after a renderer, font, token or Jest upgrade, or an intended redesign): the real assertions are green first, a triage names the affected set, each file is re-accepted alone, every changed golden is looked at and recorded, orphans go, and the whole golden project passes twice without -u. rebaseline.mjs runs each step and writes the evidence; check-rebaseline.mjs proves it. The developer approves twice.

Rules that must hold