Add designlang public-shell pack; tighten auth capture checks

Ran authenticated extract against coulomb.social; session metadata
matched anonymous Bubble defaults, so treat docs/design-extract as a
public shell baseline (PROVENANCE.md). Capture script now refuses to
overwrite storage-state.json with thin anonymous sessions.

docs/design-extract/prompts/cursor.md

@@ -0,0 +1,18 @@
+# Design brief
+Page type: **landing**.
+Material language: **flat**.
+Voice: Tone: neutral · Headings: unknown.
+## Tokens
+```ts
+export const tokens = {
+  colors: ['#000000', '#171717', '#d08728', '#ffffff', '#616161', '#e5e5e5'],
+  fonts: ['[object Object]', '[object Object]', '[object Object]', '[object Object]'],
+  radii: ['4', '8'],
+  shadows: ['rgb(97, 97, 97) 2px 2px 8px 0px'],
+};
+```
+## Sections
+- hero
+- features
+- cta
+- footer