The red watch lands; the validator reads the spec; the card chrome becomes tokens #1778

Three acceleration items in one PR (owner, 2026-10-27: "do all three autonomously... write everything in .t27")

1. The main red watch (rules in the .t27 card, thin workflow here)

The docs-check gate sat red on every docs-touching PR for two days (2026-10-24..26) behind a paths filter. The rules live in specs/crons/trinity-main-red-watch.t27 (gHashTag/t27, paired PR); this repo gets the thin host .github/workflows/main-red-watch.yml (daily 05:47 UTC): newest-main-failure or pull_request-failure-older-than-24h opens one issue; a clean day logs one line. The POST_DIR precedent of pr-blog-report.yml — the workflow reads the rules from the card.

2. The work-report validator reads the spec

pr-blog-report.yml now reads MIN_RESULT/MIN_OUTLINE/MAX_FIELD from specs/report/work_report.t27 (#1775) with the same sed pattern the workflow already uses for POST_DIR, and scripts/pr_blog_report.py takes them from the WR_* env (literals kept as the spec's own values). One home for the numbers; the drift is no longer possible silently.

3. Card chrome tokens: one home for the mirrored values

The courses card values (border #333, radius 12, pad 20, gap 10/16, title 22px, desc #a6a6a6, foot #8a8a8a) now live once as :root tokens in index.css; Course.css's .course-card* and the blog card block read them with the tokens' own values as fallbacks. The next restyle changes one place.