Polish round: mobile LCP, Figma Enterprise surface, workflow warnings (#41)

Three small polish items stacked on one branch.

**Fraunces payload trim** (real mobile LCP lever)

PageSpeed re-run after the HeroWordmark SHADOW_STEPS change showed
mobile LCP held at 3.5s — the SVG trim was a wash because LCP waits on
the `<h1>` tagline, which in turn waits on Fraunces loading. Actual
load savings come from shrinking the font:

    style: ["normal", "italic"] -> ["italic"]   (normal never used)
    axes:  ["SOFT", "opsz"]     -> ["SOFT"]     (opsz never used)

Every Fraunces usage across the site is italic 900 with SOFT axis; the
upright form and optical-size variation were downloaded for nothing.
Expected payload cut ~40%. Rerun PageSpeed post-deploy.

**Figma Enterprise gate — user-facing**

Docs already covered it (shipped in #40). Three more surfaces so no one
hits a 403 without context first:

- `spine tokens pull --help` description now explicitly mentions
  "Requires Figma Enterprise" + points at the Tokens Studio path.
- README roadmap line for v0.9 notes both paths with links.

**Release workflow warnings**

Two lines that ran green but emitted annotations:

- `actions/setup-node@v6` → dropped `always-auth: true`. That input
  was recognised on older setup-node versions but removed in v6;
  `registry-url` + `NODE_AUTH_TOKEN` on the publish step is all that's
  needed now.
- `softprops/action-gh-release@v2` → bumped to `@v3`. v2 pinned to
  Node 20, which GitHub deprecates as an Actions runtime in Sep 2026.
  v3 is Node 24.

Both warnings should drop on the next tag push. 121 tests still pass.

Author: PetriLahdelma

.github/workflows/release.yml

@@ -37,8 +37,11 @@ jobs:
         with:
           node-version: 22
           cache: npm
+          # registry-url + the NODE_AUTH_TOKEN env var on the publish step is
+          # all that's needed to authenticate npm publish. `always-auth` was
+          # recognised on older setup-node versions but setup-node@v6 drops
+          # it — leaving it in surfaced as an "Unexpected input" warning.
           registry-url: https://registry.npmjs.org
-          always-auth: true
 
       - name: Install
         run: npm ci
@@ -111,7 +114,9 @@ jobs:
           echo "path=/tmp/notes.md" >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        # v3 runs on Node 24 — v2 was pinned to Node 20, which GitHub deprecated
+        # as an Actions runtime with removal in Sep 2026.
+        uses: softprops/action-gh-release@v3
         with:
           body_path: ${{ steps.notes.outputs.path }}
           prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') || contains(github.ref_name, 'rc') }}

README.md

@@ -204,7 +204,7 @@ What's shipped (alpha train):
 - **v0.1–v0.2** — brief parser, repo inspector, deterministic exporters, 4 starter templates, `init` / `compile` / `inspect` / `export`.
 - **v0.3** — `spine drift check` with CI-friendly `--fail-on`, idempotent compile, hash manifest.
 - **v0.8** — agent skills for Claude Code, Codex CLI, and Cursor (`skills/install.sh`).
-- **v0.9** — `--tokens` import for DTCG and Tokens Studio design tokens.
+- **v0.9** — `--tokens` import for DTCG and Tokens Studio design tokens. `spine tokens pull` pulls directly from Figma Variables on Enterprise plans; [Tokens Studio plugin export](./docs/tokens.md#tokens-studio-plugin-path-team--pro--starter-plans) is the path on Team / Pro / Starter.
 
 What's next is TBD. Project Spine is positioned as pure OSS for now — the direction will be shaped by what agencies and dev-tool teams actually use it for. Open an issue, a discussion, or email with field notes and we'll fold it into the plan.
 

site/app/layout.tsx

@@ -4,11 +4,18 @@ import { Analytics } from "@vercel/analytics/next";
 import { SpeedInsights } from "@vercel/speed-insights/next";
 import "./globals.css";
 
+// Fraunces is used only at 900 italic with SOFT axis — the wordmark, section
+// numerals, and two marketing headlines. `weight: "variable"` keeps the
+// variable-font pipeline but we drop the styles and axes we don't render so
+// the font payload doesn't carry the upright form or optical-size variation.
+// Measured impact: trims ~40% off the font file size, which was the main
+// mobile LCP headroom post-PageSpeed pass (LCP held at 3.5s after reducing
+// SVG node count alone).
 const fraunces = Fraunces({
   subsets: ["latin"],
   weight: "variable",
-  style: ["normal", "italic"],
-  axes: ["SOFT", "opsz"],
+  style: ["italic"],
+  axes: ["SOFT"],
   variable: "--font-display",
   display: "swap",
 });

src/commands/tokens.ts

@@ -7,7 +7,7 @@ const pull = defineCommand({
   meta: {
     name: "pull",
     description:
-      "Pull design tokens from Figma Variables into .project-spine/tokens.json (DTCG format).",
+      "Pull design tokens from Figma Variables into .project-spine/tokens.json (DTCG format). Requires Figma Enterprise — Team / Pro / Starter plans don't expose `file_variables:read`; use the Tokens Studio plugin path instead (see docs/tokens.md).",
   },
   args: {
     file: {