ci: tighten tracker-tag lint to exclude digit-runs glued to a letter (#1555)

The tracker-tag lint's trailing class `[^0-9a-fA-F]` treated a non-hex
letter as a valid terminator, so it flagged hash-route fragments like
#24h / #1h (the stats-page window-selector routes) as tracker tags — four
false positives in the frontend. A real tracker tag is never immediately
followed by a letter, so widen the trailing class to [^0-9a-zA-Z]: still
catches every real tag (followed by space / punctuation / EOL) while
excluding any digit-run glued to a letter. Letter-bearing and 6-8-digit
hex stay excluded as before.

Also write theme.css's --crust fallback in six-digit form (#000 -> #000000)
to dodge the one remaining pure-numeric-short-hex residual the lint
documents. Pixel-identical colour. With both, the frontend tree
contributes zero lint hits; only the legacy backlog (Rust) remains.

Pattern + cases reviewed and approved by atlas on the issue.

scripts/check-issue-refs.sh

@@ -13,13 +13,15 @@
 #
 # Scope: tracked *.rs *.nix *.js *.ts *.css *.html. Markdown is exempt
 # (prose docs may legitimately cite the tracker). The pattern matches a
-# hash, 2-5 digits, then a non-hex char or end-of-line: that trailing
-# class skips CSS hex colours (letter-bearing or 6/8-digit) while still
-# catching tracker tags. Residual: a pure-numeric short hex (e.g. three
+# hash, 2-5 digits, then a non-alphanumeric char or end-of-line. A real
+# tracker tag is never glued to a letter, so the trailing class skips
+# both letter-bearing / 6-8-digit hex colours (the digit run breaks or
+# overruns) and digit-runs followed by a letter — e.g. hash-route
+# fragments like #24h. Residual: a pure-numeric short hex (e.g. three
 # identical digits) trips it — write the six-digit form to dodge.
 set -eu
 
-pattern='#[0-9]{2,5}([^0-9a-fA-F]|$)'
+pattern='#[0-9]{2,5}([^0-9a-zA-Z]|$)'
 
 # `/dev/null` forces grep to always print a filename prefix, even when
 # xargs hands it a single file. `-r`/`-0` keep it robust to odd paths