Add generated theme-aware figures (block 2)

[jothimani-rajendran]

What

Adds the block-2 launch programme's generated, theme-aware figures: the shared
open-coder-ai family diagram and chock's own figure -- one policy fanning into the
eight enforcement surfaces chock.compile.surfaces.Surface defines, each labelled
with how many of chock's 15 supported agent names actually reach it and whether that
reach is advisory, enforced-at-commit, or enforced in-agent. Every count is read from
SURFACE_AGENTS / CHOCK_AGENT at generation time, never typed by hand. A new
.github/workflows/figures.yml job regenerates every figure and fails on drift; it is
a separate workflow rather than a ci.yml job because ci.yml already sits at this
repo's 300-line review budget (tests/test_repo_standards.py), whose own failure
message asks for a split by activity rather than a bigger file.

Three of the eight surfaces (managed-setting, gateway, mcp-gateway) are drawn in
the figure's neutral colour, not the enforcement ramp, because no agent reaches them
today -- the same honesty the README's existing omission caveat and
docs/enforcement-surfaces.md already carry. docs/figures/palette.py and
make_family.py are the launch programme's shared, byte-identical tooling, copied
verbatim from every other repo in the family and never hand-edited here.

Known pre-existing failures (not from this PR)

chock check and two pytest tests (test_compiled_freshness.py,
test_runtime_goldens.py) fail in this environment because the installed agentseam
build's vendored runtime bytes differ from what .chock/bin/ and the frozen goldens
committed on main expect. Verified with git stash against unmodified main at
2889776 before making any change here -- same failures, same files, nothing to do
with figures. Left untouched: regenerating vendored runtime/goldens is a separate,
unrelated fix this PR should not carry.

Definition of done

• chock check -- 0 errors, 0 warnings, 0 infos (fails today only on the
  pre-existing vendored-runtime drift above, unrelated to this PR)
• chock check --only matrix passes; no behavior changed, matrix untouched
• chock sync --repo . --check clean (no manifest touched by this PR)
• chock check --only verify (fails today only on the same pre-existing drift)
• Registry rescanned; no stale entries (no packs/policies touched)
• pytest -q -- 1134 passed, 2 skipped, 2 pre-existing failures (see above);
  new checks (figures drift) have both a clean-diff and an induced-drift test,
  pasted in the launch report
• pytest acceptance/ ... unaffected -- no packaging/init/hook change
• No artifacts to migrate -- no check added or extended
• No manifests touched -- no version bump needed
• ruff check . and ruff format --check . clean

Claims

• No surface is described as enforcing more than it installs. The new figure
  marks managed-setting, gateway and mcp-gateway neutral (not the
  enforcement ramp) with the same reasons docs/enforcement-surfaces.md already
  gives; INSTALLED_SURFACES and the coverage table are unchanged by this PR.

Note

This PR merged before a final shared-tooling sync commit could land; see the
follow-up PR that brings docs/figures/make_family.py to its final byte-identical
revision.

🤖 Generated with Claude Code