Icon QA lets weak or off-brand icons pass #57

Status: Verified during the Pick Your AI rollout (reproduced, or read directly in the code).

Part of epic: Epic: Make the repo-icon pipeline reliable and honest.

Summary

family-ink is only a warning, so an old CompleteTech-blue icon passed a Pick Your AI check with warn. The contrast floor is 3:1, which accepted a dim 3.17:1 icon, and no-text is manual with no OCR hook.

Evidence

• content icon check returned warn (not fail) for an old blue icon during the rollout.
• content.py: family-ink has level="warn", contrast-on-card requires 3.0, no-text is manual.

Impact

Wrong-brand or hard-to-read icons reach a PR unless the operator reads every check.

Proposed fix

Add a strict mode that fails on family-ink, raise or configure the contrast floor, and add an optional OCR check.

Acceptance criteria

• --strict fails on family-ink warn.
• Optional OCR (tesseract) runs when present and is skipped with a log when absent.

Tasks

Each task below is a sub-issue.

Prior work

Prior work: open PR #20 (opt-in --allow-t3 and the Pick Your AI family), open #7 and PR #13 (variant J badges), merged PRs #14 to #19 (icon art-direction path, UTF-8 output, registry-free org health and label planning, Windows test portability, footer URL repair) and closed issues #8 to #12. Nothing here duplicates those; where an item is already handled it is linked, not refiled.

Fresh VM verification: not run. Findings were verified on a Windows host; hosted CI is separate evidence.