T10.8: verification (390px/1440px, full suite, per-task done-when)

Walked T10.1-T10.5's claims against the actual code (env vars, routes,
JIT provisioning, the password-removal sweep, login.html) rather than
re-trusting this file's own prose. No drift found.

Full suite via the Docker runner: 39/41 files clean. token_check.py's
exit 2 is a harness mismatch (needs --out/--compare, not a bare run),
not a failure. generalinfo_check.py is 48/49 - the one failure is a
pre-existing rgba() shadow literal from the D11 Micron-assets merge,
confirmed via git show HEAD to predate this wave; logged as BL-031,
not fixed here. okta_auth_check.py re-run fresh: 22/22.

390px/1440px: baseline_shots.py captured all fourteen shots. Visually
confirmed login.html and users.html show the Okta-only sign-in and the
password-free admin UI at both widths.

Wave 10 complete.

docs/waves/backlog.md

@@ -626,6 +626,28 @@ deliberately deferred.
 - **Suggested wave or follow-up:** next housekeeping pass, alongside any other
   post-cutover schema tidy-up.
 
+### BL-031 — A raw `rgba()` shadow survives in the creator's stylesheet
+
+- **Found during:** T10.8 (the full suite could finally run through Docker; the
+  dev sandbox never had a headless browser to run it in before)
+- **Where:** `html/wp-creation-styles.css:929`, `.asset-results { ... box-shadow:0
+  8px 24px rgba(20,30,50,.18); }`
+- **What:** `generalinfo_check.py` asserts the whole file carries no raw colour
+  literal (comments excluded) as part of its CR-003 priority-colour check, and
+  this one line fails it: 48/49. Confirmed via `git show HEAD` that the literal
+  is already committed, byte-identical, unrelated to wave 10 — it is the Micron
+  asset picker's dropdown shadow, which arrived with the `origin/Micron-Assets`
+  merge (D11, 2026-08-20) and was never swept by `C4`'s token pass (`T9.9`
+  closed before D11 merged). The fix is a straight swap:
+  `theme-light.css:217` already declares `--wp-shadow-menu: 0 8px 24px
+  rgba(20, 30, 50, .18)`, the identical value — this line should read
+  `box-shadow:var(--wp-shadow-menu);`.
+- **Why not now:** unrelated to the Okta wave; fixing a D11-era CSS literal
+  inside T10.8 (auth verification) is exactly the drive-by `CLAUDE.md` forbids.
+- **Suggested wave or follow-up:** next housekeeping pass, with `C4`'s other
+  leftovers. One-line fix, `generalinfo_check.py` already pins it (49/49 once
+  fixed).
+
 ### BL-030 — `DEPLOY-login-portal.md` is fully stale
 
 - **Found during:** T10.9