frontend: shared <hive-warn> component for inline warning banners

Consolidates three independently-written instances of the same thing:
.cred-warning (credentials.html, static markup), .tombstone-warn
(core.js, JS-built), .port-conflict (swarm.js, JS-built) -- the first
two differed only by an undeliberate 10% vs 8% tint, the strongest
argument this was drift rather than three genuinely different needs.

New autonomous custom element, frontend/packages/shared/src/hive-warn/,
matching the established one-component-one-dir shadow-DOM pattern
(hive-btn, hive-toast, hive-dialog). Purely presentational -- no
lifecycle beyond attaching its shadow root once, no
attributeChangedCallback needed since severity/pulse are read directly
by :host([...]) CSS selectors rather than mirrored onto an inner
element. Content passes through via a single default <slot>, so every
call site keeps writing its existing <strong>/<code> markup unchanged.

API: <hive-warn> (amber, default) / <hive-warn severity="red"> for an
active incident vs a standing caveat, plus an opt-in pulse boolean
modifier (only the port-collision banner wants it -- a banner that's
always present and always pulsing just trains you to stop seeing it).
Tint is a single canonical 8% for both severities now, replacing the
10%/8% split.

Registered once in dashboard's common.js (same side-effect-import
pattern as <hive-side-panel>) so every dashboard page picks it up
without a per-file import, since all three call sites (core.js,
swarm.js, credentials.js) already transitively import it.

Verified: npm run build clean for both dashboard and agent packages,
grepped source for leftover cred-warning/tombstone-warn/port-conflict
references (none), confirmed hive-warn/HiveWarn/hive-warn-pulse present
in every affected dist bundle, confirmed the still-live
questions-pulse keyframe (.questions) untouched.

frontend/packages/dashboard/src/credentials.html

@@ -90,7 +90,7 @@
          Security-warning banner + a link to generate a PAT. -->
     <section class="cred-pane" id="cred-pane-github" data-tab-pane="github"
              role="tabpanel" aria-labelledby="cred-tab-github" hidden>
-      <div class="cred-warning">
+      <hive-warn>
         ⚠ use a <strong>dedicated bot account</strong>, not a human's &mdash;
         and a <strong>minimally-scoped</strong> personal access token (only
         the repos/scopes the agent actually needs, e.g. <code>repo</code> +
@@ -98,7 +98,7 @@
         anything within the token's scopes is reachable if the agent is
         ever compromised. the token is injected into the agent's state dir
         and is <strong>never displayed back</strong> on this page.
-      </div>
+      </hive-warn>
 
       <h3>◇ status</h3>
       <div id="gh-status" class="gh-status"><p class="meta">select an agent to see its github credential status.</p></div>