fix(fonts): parse font family values safely

[jrusso1020]

Summary

• replace raw comma splitting with one shared quote/escape/parenthesis-aware font-family parser
• preserve lexical token metadata so quoted names remain literal families while unquoted CSS functions remain unresolved
• use the same parser and static-root resolver in deterministic injection, distributed plan validation, and lint
• resolve only unambiguous unconditional top-level :root custom properties; scoped, dynamic, cyclic, inline, or same-name malformed declarations remain unresolved
• extract concrete var() fallback candidates without manufacturing Montserrat Bold") or serif) names

Why

Fresh production failures include raw comma-split artifacts, CSS-wide values such as inherit, and valid fallback families hidden inside var(). The previous producer and lint implementations interpreted these values differently. This PR makes those surfaces agree while preserving existing browser-cascade behavior for unresolved variables.

This is stacked on #2768, which contains the observed deterministic alias containment. It does not enable new render routing or add a new default plan rejection.

Correctness and rollout

• quoted "ACME(Display)" and "var(--Display)" stay real family names
• quoted "inherit", "serif", and "system-ui" are literal families; only unquoted forms are CSS-wide/generic values
• unquoted var()/env() remain unresolved and are not fetched or newly rejected by plan validation
• malformed CSS invalidates only custom-property names it actually mentions, rather than disabling every valid root alias
• static root system-font primaries still fail the existing distributed validation
• this changes compiled font-face bytes for affected compositions, so it should follow the candidate screenshot/parity lane before stable promotion

Validation

• 107 focused parser, deterministic injection, lint, normalization, and plan smoke tests
• parser and lint typechecks
• producer typecheck through the required pre-commit hook after generating the ignored runtime artifact
• oxlint, oxfmt, tracked-artifact, classification, Fallow, and diff checks
• independent review found and verified fixes for:
  1. quoted function-shaped names losing provenance
  2. unrelated malformed CSS globally disabling aliases
  3. quoted CSS-wide/generic names being misclassified