build: no dist-level smoke check that @simlin/diagram CSS (theme.css/reset.css) lands in serve-web bundle

[bpowers]

Problem

The @simlin/diagram global-CSS delivery contract -- theme.css and reset.css actually reaching consumer bundles -- is pinned only by source-text tests:

• src/diagram/tests/theme-tokens.test.ts asserts that index.ts textually contains the CSS imports and that package.json sideEffects lists lib*/index.js + lib*/StaticDiagram.js.
• src/simlin-serve/web/src/entry-css.test.ts similarly asserts on the text of main.tsx / styles.css.

These catch someone deleting the imports or the sideEffects entries, but they do NOT catch a bundler-semantics drift: e.g. a future Vite/rspack major changing how sideEffects globs are matched, or a resolution change that routes around lib.browser/index.js. Such a drift would silently re-ship black diagrams -- when var(--color-white) is undefined, SVG fills fall back to black -- with all existing tests still green.

Issue #708 documents that this failure mode is real: rspack already dropped a declared CSS side-effect import when @simlin/diagram was consumed through a source alias in src/app. That issue tracks the root-cause investigation for src/app; this issue tracks the missing dist-level verification so any recurrence (in any consumer) fails CI instead of shipping.

Why it matters

• Correctness: the failure mode is visually catastrophic (all-black diagrams, unstyled toolbar) but produces no build error or test failure.
• The contract crosses package boundaries (diagram source -> built lib.browser -> serve-web Vite bundle), which is exactly where unit tests can't see.

Components affected

• src/simlin-serve/web (Vite build, dist/ output)
• src/diagram (package.json sideEffects, index.ts CSS imports)
• CI workflow

Possible approach

Add a dist-level smoke assertion: after pnpm --filter @simlin/serve-web build, grep src/simlin-serve/web/dist/assets/index-*.css for --color-white: (and optionally a reset.css marker). Candidate homes:

• a CI step immediately after the serve-web build, or
• a small script invoked from the simlin-serve build/test flow so it also runs locally.

Discovery context

Identified 2026-07-02 while fixing simlin-serve's black-diagram / missing-toolbar-styling bug. Root cause of that bug: the sideEffects array declared all JS pure, so bundlers dropped lib.browser/index.js's bare CSS imports. The source-text tests above were added as part of that fix; this issue covers the remaining gap they leave.

Related: #708 (rspack drops declared CSS side-effect import in src/app -- same failure family, different consumer and different ask).