feat(theme): share the token→CSS renderer in craig-state-bundle

Phase 1 / epic &60 (closed). Move materialize_theme_css (+ private helpers render_palette_css/render_block/validate_palette + ThemeBootError) from services/craig-web/src/theme.rs into crates/craig-state-bundle; re-export only materialize_theme_css/ThemeBootError at the crate root. craig-web imports them (delete its local defs); the generated-CSS banner comment becomes service-neutral so output stays byte-identical except that line. NOTE: active_contribution()/candidate_bundles() (craig-web bundle.rs) do NOT move — they reference the concrete bundle crates and would cycle; they're replicated per-binary in the next issue.

AC:

• renderer lives in craig-state-bundle; only materialize_theme_css+ThemeBootError public
• craig-web compiles + tests green; output byte-identical bar the banner comment
• no new runtime toml