[ZacxDev]

Automated by the bump-scaffold-pins workflow (internal/scaffold/cmd/bump-pins).

One or more @civitai/* packages published a new minor, so a
scaffold's pre-1.0 caret pins fell behind npm and the
pins-vs-published guard would go red. This PR rewrites the stale
literal pins wherever they appear:

• internal/scaffold/templates/page-money/package.json.tmpl
• internal/scaffold/scaffold_test.go (page-money's mustContain canary)
• internal/scaffold/templates/page-elements/package.json.tmpl
• internal/scaffold/page_elements_test.go (page-elements' pin canary)

and regenerates internal/scaffold/testdata/design-tokens.txt (the
design-token ledger) when the @civitai/blocks-react pin or its
token set moved, or the ledger is missing.

The pins are rewritten as literals (not templated) on purpose:
the guard reads the raw ^X.Y.Z bytes out of the .tmpl, so
templating the value would blind it.

CI note: this PR is opened with a scoped fine-grained token
(secrets.BUMP_SCAFFOLD_PINS_TOKEN, Contents + Pull requests RW on
this repo only), not the default GITHUB_TOKEN — so the repo's
normal checks (pins-vs-published / scaffold-currency) DO run on
it. As defense-in-depth the bump job RUNS three checks before opening
the PR — the network guard (CIVITAI_CHECK_PUBLISHED_PINS=1 go test -run TestScaffoldPinsSatisfyPublished), the full offline scaffold
suite, and a fresh civitai app init scaffold that installs,
typechecks and builds against the bumped SDK (which is what would
catch a removed/renamed export).

The first two must pass or this PR is not opened at all. The third
does NOT block it — a failure there opens this PR as a draft
instead, because withholding the bump keeps main red and blocks every
PR that touches a pin input (#530 was the whole repo, before that was
narrowed).
Its result for this run is stated on the last line below; do not read
"the bump job validates" as "everything passed".

Scaffold build validation: success.