feat(tui): add high-contrast light palette

[directsol]

Summary

• adds a light TUI palette for terminals with light backgrounds
• persists the selection through orch config global set palette light
• makes alternating activity rows palette-aware
• fixes active/flashing tab contrast with a semantic solid-fill foreground
• keeps light gray and ghost tokens distinct during live palette remapping
• updates vulnerable or stale dependency paths to patched releases
• expands CHANGELOG.md release notes for the feature, fixes, security work, and validation

Why

The original light palette used a dark foreground on saturated amber and status fills, which made active and flashing tab labels fail readable contrast in several states. It also assigned the same value to gray and ghost, making semantic remapping ambiguous when switching away from the light palette. The dependency graph additionally needed patched versions of direct and transitive packages.

Impact

Users can run ORCH on light terminal backgrounds without unreadable active tabs or incorrect remapped colors. Existing Amber, Ocean, Forest, and Violet behavior remains unchanged. Global palette configuration remains backward-compatible and defaults to Amber when no valid value is stored.

Release notes

The Unreleased section of CHANGELOG.md now documents the light palette, contrast and remapping fixes, dependency hardening, regression coverage, PTY E2E validation, and coverage totals.

Validation

• npm ci --ignore-scripts
• source typecheck: npm run typecheck
• test typecheck: npx tsc -p tsconfig.test.json --noEmit
• full suite: 126 files, 2078 passed, 2 skipped
• coverage: 69.72% statements, 63.37% branches, 69.64% functions, 71.94% lines
• production build: npm run build
• real PTY activity E2E: 11/11
• command-bar smoke: 18/18
• full-cycle smoke: 18/18
• TUI integration smoke: 15/15
• isolated light-palette E2E: persisted config, fresh-process readback, production PTY boot, ANSI color assertion, clean shutdown
• npm audit --audit-level=low: 0 vulnerabilities
• npm audit signatures: 155 verified registry signatures and 37 verified attestations

[github-actions]

🎉 Thanks for your first PR to ORCH! We're excited to review your contribution.

Our CI will run automatically:

• ✅ TypeScript strict mode check (tsc --noEmit)
• ✅ Full test suite (1493+ tests via Vitest)
• ✅ ESM build verification

A maintainer will review your changes shortly. In the meantime, check the Contributing Guide to make sure everything is in order.

⭐ If you enjoy working with ORCH, a star on the repo goes a long way!