The audio-transcription template's filter tabs used the full pill radius,
which the brand design system reserves for tags/badges and explicitly
bars from CTA-like elements. Switch to --radius-cta (4px) so the tabs
match the documented button radius.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The pre-commit job installed deps with `pip install -e . --group dev`, so its
pytest hook ran against the newest PyPI releases instead of uv.lock. A newer
assemblyai (0.64.9 vs the locked 0.64.4) adds a SpeechModel value
(`u3-rt-pro-beta-1`), which changes `aai stream --help` and breaks the
byte-exact help snapshot — even though the locked check.sh jobs pass.

Run the hook via `uv run --frozen python -m pytest` and bootstrap uv +
`uv sync --frozen` in the CI job (same uv-from-PyPI pattern the check.sh job
already uses), so every test path resolves the lockfile versions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Map the AssemblyAI marketing design system onto the CLI color scheme:

- Primary accent moves from the old blue (#2545D3) to Cobolt 400 (#614fd2),
  the terminal-legible mid step between the web primary (Cobolt 500) and the
  dark-mode primary (Cobolt 300); secondary accent (agent label, links) becomes
  the lighter Cobolt 300 (#887bdd).
- Errors use the design system's semantic red (#F04438).
- Typer's help palette (short switch, type metavar, usage line) is brought into
  the Cobolt family: flags/command names in bold Cobolt, metavar in lighter
  Cobolt, and the "Usage:" label/arg spec dropped to muted warm gray (#777673)
  so boilerplate recedes instead of shouting in yellow.

Speaker palette, success green, and warn yellow are left as-is: the brand has
no categorical multi-hue scale, and those status colors have no brand analog.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The two color-status tests asserted exact ANSI escapes, but Rich reads ambient
color env (NO_COLOR/COLORTERM/...) at render time. That global state leaked
across test collection, so a truecolor console could downsample to 16-color (or
vice versa) depending on what ran first — each test passed alone but they
interfered in the full suite. Pass _environ={} so the color depth is fixed by
color_system alone, and assert the resulting deterministic truecolor bytes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add two hermeticity guards beyond order-randomization:

- pytest-socket (--disable-socket) blocks real network in the unit suite, so
  an unmocked SDK/HTTP call fails loudly instead of silently hitting the API.
  The loopback-binding tests (OAuth callback server, find_free_port) opt back
  in with @pytest.mark.allow_hosts(["127.0.0.1"]) — never enable_socket, which
  would also unblock external hosts.
- An autouse pin_timezone fixture pins TZ to a fixed non-UTC zone so time
  rendering is deterministic across machines; time-machine is added for tests
  that need to freeze "now". The CLI is UTC-normalized, so this surfaced no
  failures — it guards against future naive-local-clock regressions.

e2e/install suites drive the CLI as a subprocess, so the in-process socket
patch never touches them. Full gate green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The suite-wide --disable-socket broke the `install`/`install_script` tests:
they probe PyPI in-process (urlopen https://pypi.org/simple/) to decide
whether to run or skip, which pytest-socket now denies — failing the
pre-commit pytest hook and the "package install — real" jobs.

Add a pytest_collection_modifyitems hook that auto-applies enable_socket to
any test marked e2e/install/install_script. Those markers already mean "this
suite needs the real network", so the carve-out is central and future-proof;
loopback-only unit tests keep the tighter allow_hosts(["127.0.0.1"]).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>