fix(ui): draw every widget from the Colony palette and fonts and finish the French labels

[MotherSphere]

Closes the conformance gaps the independent audit left open.

UI and typography

• App::theme now returns an iced Theme::custom built from the active Colony palette (background, text, accent, success, warning, error), so scrollbars, selection and every default-styled widget follow the chosen theme, accent and high contrast instead of iced's stock Light or Dark.
• README, changelog and release notes render with a Colony-built Markdown style: ui_font() for body, inline code and code blocks (no system monospace, and the dyslexia font applies without a restart), accent links, inline code on BG_CARD in TEXT_PRIMARY. Code blocks use a palette container instead of iced's hardcoded dark one.
• The Back and Rescan buttons and the search input have explicit palette styles; the search input uses ui_font().
• The app hexagon, its category glyph and the installed/update status hexes are drawn with fonts::glyph_font(), so they no longer vanish when the dyslexia font is on.
• The GitHub sidebar entry uses widgets::selection_style, like the section entries: accent fill with contrast_on text while the menu is open, hover state otherwise.

Localisation

• Category chips go through section_display_name, so the French grid reads "Utilitaires" or "Jeux" instead of the manifest key or the English enum name. New test covers every AppCategory.
• The grid's status and launch columns scale with font_scale(), so the French labels fit at the largest text sizes.
• French: no_release_unrecognized no longer says "assets", tab_readme is "Présentation", tut_sidebar_desc drops "vs.".
• The Storage caches section has its own settings_section_caches / settings_caches_desc keys instead of reusing the button label.

Repository

• Every em and en dash outside CHANGELOG.md and LICENSE is gone (user strings, comments, the AUR workflow, the feature request template). The v0.1.0 and v0.2.0 release notes were edited to English without dashes; CHANGELOG.md is left as generated.
• The search test fixture is in English.
• .gitignore keeps only /target and **/*.rs.bk.

Docs

• README follows the program template order: Why, What it does (with Themes), Installation (with Platforms), Documentation (with the app-author pointers), Code signing policy, Privacy, License.
• The Status reports v0.11.0 as the first release built, signed and published by the shared sign-and-publish workflow, which also bumped colony-bin.
• The SignPath credit and team roles sit in the template's commented block until signpath-project-slug is set; the unmeasured "Design principles" claims are gone.
• SECURITY.md says a fix ships when its release pull request is merged.

Dependencies

• serde_json 1.0.154, tokio 1.53.3, keyring-core 1.0.1, sha2 0.11.1, zip 9.0.3, winresource 0.1.34, plus a cargo update of the transitive crates within the 1.88 MSRV.

Local checks: cargo clippy --all-targets --locked -- -D warnings clean; the i18n, theme-count and search tests pass. A visual pass in French at the large and extra-large text sizes is still worth doing.