Retarget forbidColours() at where 2.0.0 writes a role

Plan step 41 review (the user, 2026-09-15): an application without Tailwind
names a role through its --md-sys-color-* custom property (CSS, an inline
style, a script), an md-ink-* class, or a component's color/tone prop, not
a bg-tertiary utility. forbidColours() keeps its name and signature and
reports each of those, the role's on- and container roles included;
a Tailwind leftover stays family (i)'s single report. ReStride's
forbidColours(['tertiary', 'primary-container']) keeps its meaning.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qwx5USif3wFFmxtHg5U1g9

tests/Fixtures/design-guard/forbidden-colours/app.css

@@ -0,0 +1,9 @@
+/* var(--md-sys-color-tertiary) in a comment is ignored */
+.hero {
+    background: var(--md-sys-color-tertiary-container);
+    color: var(--md-sys-color-on-primary-container);
+}
+
+.fine {
+    color: var(--md-sys-color-primary);
+}