fix(web): restore single-primary-action hierarchy and canonical button variants

[jeanduplessis]

Problem

Many surfaces use blue, purple, green, amber, gradient, or hand-painted yellow action fills; selected controls also consume primary yellow, producing multiple competing CTAs.

Remediation action

Normalize audited actions onto authoritative Button variants and enforce one primary CTA per surface.

Representative scope

• apps/web/src/components/WelcomeContent.tsx:148
• apps/web/src/app/get-started/slack/_components/SlackConnectStep.tsx:102
• apps/web/src/components/cloud-agent-next/PermissionCard.tsx:171
• apps/web/src/components/app-builder/AppBuilderPreview.tsx:361
• apps/web/src/components/security-agent/SecurityConfigSections.tsx:222
• apps/web/src/components/auto-fix/AutoFixTicketsCard.tsx:268
• apps/web/src/app/(app)/claw/components/OpenClawButton.tsx:12
• apps/web/src/components/gastown/drawer-panels/BeadPanel.tsx:352
• apps/web/src/app/(app)/wasteland/by-id/[wastelandId]/wanted/WantedBoardClient.tsx:938
• apps/web/src/app/(app)/learn/page.tsx:78

Acceptance criteria

• Each surface has at most one default/primary Button.
• Secondary selection uses surface.selected; ordinary actions use secondary, outline, or ghost variants.
• Destructive variant is reserved for destructive action; success/warning colors are not ordinary button fills.
• Gradients, custom shadows, press scaling, and local focus colors are removed from action styling.
• Legacy apps/web/src/components/Button.tsx consumers in audited flows migrate to ui/button.