[Bug] ColorPage sample snippet still teaches a raw PUA glyph with no `.FontFamily` — the class #999 fixed has no gate

## Summary

`samples/ReactorGallery/ControlPages/DesignGuidance/ColorPage.cs:259` contains a `SampleCard` source snippet that renders a Private Use Area codepoint as plain `TextBlock` content **without** a `.FontFamily(...)`. Copy-pasting it produces tofu (the `.notdef` box).

This is the same defect class #999 fixed (`Closes #979`), surviving in a `sourceCode:` string that the sweep did not cover.

## Evidence

Verified against `origin/main` via the contents API. **The live code 54 lines above is correct**, which is what makes this a drift rather than an oversight:

```csharp
// :204-208 LIVE CODE — correct
Border(HStack(8,
TextBlock("\uE930")
.FontFamily("Segoe Fluent Icons, Segoe MDL2 Assets") // <-- present
.Margin(4, 4, 0, 4)
.Foreground(Theme.SystemSuccess),
TextBlock("Operation completed successfully").Foreground(Theme.PrimaryText)
```

```csharp
// :258-260 THE SNIPPET — inside a verbatim string, no .FontFamily
// System Signal
Border(HStack(8, TextBlock(""\uE930"").Foreground(Theme.SystemSuccess), TextBlock(""Operation completed successfully"")))
.Background(Theme.SystemSuccessBackground)");
```

The doubled `""` confirms it is inside the verbatim `sourceCode:` literal. The card therefore **displays** correct output while **teaching** the broken pattern — a reader who copies what the gallery shows them gets a different result from what the gallery rendered.

## Why the rendering outcome is settled, not assumed

The session behind #999 established this empirically before writing that fix, rather than reasoning from font-fallback behaviour:

- Ran the gallery, navigated to **Navigation → TitleBar**, located the button via UIA, and photographed it — it rendered the `.notdef` empty rectangle.
- The button's UIA `Name` was **empty**: a PUA codepoint as string content yields no accessible name.
- The two title-bar buttons on the *same page* rendered correctly because they take the `Icon(...)` path — a **same-window, same-theme, same-render-pass differential**.

So: **Windows font fallback does not rescue PUA codepoints in default-font text.** The snippet is broken, not merely stylistically inconsistent.

## The structural problem, which matters more than the one line

**There is no lint for this.** `tests/Reactor.Tests/Tooling/GallerySampleLintTests.cs` on `main` contains no rule matching PUA ranges, `FontFamily`, or `Segoe` — so nothing prevents the class from returning, and in fact **one instance survived the PR that fixed the class**.

Snippets are the worst hiding place for it: they are verbatim strings, so **no compiler, analyzer, or runtime check ever inspects them**. The only thing that can catch a broken snippet is a lint that reads them as text.

Two considerations for whoever picks this up:

1. **A single-line grep is the wrong instrument in both directions.** The #999 sweep produced *both* a false all-clear (grepping one literal codepoint instead of the PUA range, missing two real sites) and a false positive (flagging `ReactorCharting.Gallery`, whose `.FontFamily(...)` sat 14 lines below the hit). Fluent chains defeat line-local matching by construction — the rule must consider the whole chain.
2. **`GallerySampleLintTests.cs` is the natural home, and two open PRs are already extending it.** Worth coordinating so a third rule set doesn't land beside them and merge cleanly into mutual silence.

## Suggested fix

Add `.FontFamily("Segoe Fluent Icons, Segoe MDL2 Assets")` to the snippet at `:259` so it matches the live code at `:205-206`, and add a lint rule asserting that any PUA codepoint reachable as `TextBlock`/`Button` string content is accompanied by a font family somewhere in its chain.

**The lint should be validated by conviction, not by passing** — confirm it reddens on the pre-fix `:259` text. A rule that passes on a file it has never convicted anything in is indistinguishable from a rule that does not run.

Inspect samples/ReactorGallery/ControlPages/DesignGuidance/ColorPage.cs around line 259 and tests/Reactor.Tests/Tooling/GallerySampleLintTests.cs. First run the existing gallery sample lint and verify it convicts the pre-fix PUA snippet; review the current rules before extending them. Done means the snippet uses the required font family and the lint detects equivalent broken TextBlock or Button content cases.

Written by the indexing model from the issue text.