C4 fix - five undefined token names rendered surfaces transparent

The T9.9 token sweep pointed seven files (help.js, auth-guard.js, wp-format.js,
project-data.js, index.html, field.html, wp-creation-app.js) at Carbon names
the theme never defined: --cds-layer-01/-02, --cds-border-subtle-01/-strong-01,
--cds-layer-hover-01. theme-light.css carries no -01 suffixes. An undefined
var() invalidates the whole declaration, so the help-centre modal, the
change-password and language dialogs, the print popup's inlined values, the
creator nav drawer and the sync badge all rendered TRANSPARENT backgrounds -
reported by Nick against the help menu, 2026-08-20.

Renamed every consumer to the canonical tokens (--cds-layer, --cds-layer-accent,
--cds-layer-hover, --cds-border-subtle, --cds-border-strong), matched to the
hex each replacement originally stood in for. color_check gains check 3: every
var() consumed anywhere must resolve to a definition somewhere - the class of
this bug, pinned. Verified live: the modal computes rgb(255,255,255) over an
opaque gray nav, and the language dialog is opaque too. BL-025 logged for the
one wrong-base-colour rgba tint noticed in passing.

Item: C4 (regression in its own enforcement). Probe: color_check 5/5.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/waves/backlog.md

@@ -536,3 +536,20 @@ deliberately deferred.
 - **Why not now:** converting three more pages inside the audit task is the
   drive-by CLAUDE.md forbids; the audit's job was to measure and document.
 - **Suggested wave or follow-up:** next revision, one task, using the T7.9 kit.
+
+### BL-025 — The second brand blue survives as one rgba focus tint in help.js
+
+- **Found during:** the 2026-08-20 transparency fix (undefined-token sweep)
+- **Where:** `help.js`, the help-centre search input's `:focus` rule:
+  `box-shadow:0 0 0 2px rgba(37,99,214,.15)`
+- **What:** BL-008 removed the second brand blue (#2563d6 = rgb 37,99,214) and
+  `color_check` greps both spellings — but only inside `theme-light.css`, and
+  only with spaces (`37, 99, 214`). This space-free rgba consumer slid past
+  both nets. C4's recorded exception legitimately allows rgba **alphas** as
+  opacity recipes, so this is not a token-rule defect; it is the wrong BASE
+  colour under the alpha. The correct tint is THE blue: `rgba(15,98,254,.15)`.
+- **Why not now:** noticed in passing during an unrelated fix; one-line change
+  plus widening `color_check`'s grep to space-free spellings deserves its own
+  entry rather than a drive-by.
+- **Suggested wave or follow-up:** next housekeeping pass, with the check
+  widened so it cannot recur.