Worker portal redesign — Stage 1.5 panel-state primitives upgrade

Same file as Stage 1. The four new macros land in services/canopy-web/templates/_primitives/orchard.html alongside the original 8. Grouping the design system in one file keeps the import surface tight (one {% import "_primitives/orchard.html" as o %} line per consumer) and matches Stage 1 Decision 2.

Macros wrap existing classes; no class renames or deletions. o::empty_state emits <div class="card u-empty-state">…</div>. o::skeleton emits <div class="skeleton u-h-X u-w-Y">…</div>. o::error_block emits <div class="u-error-block">…</div>. The existing CSS classes stay in canopy-web.css as the macro’s implementation — they are not deprecated, not renamed, not removed. This is a continuation of Stage 1 Decision 4. The earlier issue body’s "deprecated and removed once all callers migrate (within this MR)" language was written before Stage 1 locked Decision 4 and is superseded by it.

Skeleton sizing is a discrete enum, not parametric pixels. o::skeleton(h="md", w="full") maps internally to the existing .u-h-N + .u-w-N utility classes (h ∈ {"sm"→u-h-5, "md"→u-h-10}, w ∈ {"30","60","90","full"}). No inline style="..." attribute on any primitive — canopy-web ships strict CSP style-src 'self' with no 'unsafe-inline' (services/canopy-web/src/csp.rs:27-35). Same constraint that drove Stage 1’s gold_rule enum.

o::skeleton_row(columns) composes o::skeleton — columns ∈ {2, 3, 4, 5, 6} (default 4). The macro emits a horizontal u-flex row with one .skeleton bar per column. Replaces both _skeleton.html (vertical stack of 4 bars) and cases/search.html lines 34-40 (3 horizontal bars). Implemented as five explicit {% if columns == N %} branches (no range() filter, no integer iteration) — keeps the macro template Askama-version-portable and CSP-clean. The originally-planned avatar: bool parameter was dropped — no consumer needs avatars in v1, and adding one would require a new .skeleton--avatar CSS class (violates Decision 2’s "no CSS changes" stance).

o::empty_state(title="", body="", cta_label="", cta_href="") with body via {{ caller() }}. title and body are convenience args for the common case (one heading + one paragraph). {{ caller() }} is the escape hatch for richer empty states — caller can compose o::leaf_glyph or arbitrary HTML in the body slot. CTA pair (cta_label, cta_href) renders a <a class="u-link-primary"> link when both are present. Internal-only links (no external href validation needed — Askama HTML-escapes by default). The originally-planned icon enum was dropped — the caller-body escape hatch already covers the icon case without bundling folder/search SVGs in v1.

o::error_block(title, body, last_known_at="", retry_url="", retry_target="", status_href=""). Required title + body strings. Optional last_known_at renders as muted timestamp text (the caller formats the timestamp server-side — the macro takes a pre-formatted &str). Optional retry_url + retry_target pair emits an htmx button with hx-get + hx-target; renders only when both are non-empty. Optional status_href renders a "Service status" link.

Smoke fixture extends, doesn’t replace. _smoke.html gains four new data-smoke-block sections for the new macros. The Stage 1 contract (every macro + variant has a data-smoke-block) carries forward. primitives_test.rs::smoke_emits_no_inline_style_attributes is the CSP guard.

Validating panel: cases/search.html + cases/results.html + new cases/_results_error.html. This surface already has loading + empty + populated wired (htmx-indicator block + u-empty-state block + table). Stage 1.5 migrates those three to macros and adds a fourth — _results_error.html with o::error_block(retry_url="/cases/search?q=…​", retry_target="#search-results"). Handler returns the error template on Err() from the upstream canopy-persons call. Server-side branching (handler matches Ok vs Err and renders the appropriate template) with HTTP 200 on both arms — avoids needing the htmx-response-targets extension (not currently loaded in base.html) and avoids changing the global htmx responseHandling config (which would affect every htmx-driven route in canopy-web, including the 30 action handlers that may emit 4xx/5xx with non-fragment bodies). The semantic imperfection (200 OK with error content) is local to this surface; future MRs can introduce the extension if more error surfaces need it. Picking case-search avoids dashboard.spec.ts dependency (Stage 1 deferred dashboard.html rewrite for this reason).

Convention rule = documented + tested, not auto-linted. The four-state rule (every panel renders all four states) lands in .claude/docs/coding-conventions.md as the Worker portal patterns subsection. Enforcement is primitives_test.rs test coverage (every macro × every variant) + Playwright panel-states.spec.ts (validates the in-tree validating surface). A future "every-panel auto-lint" is out of scope — Askama templates are not statically introspectable enough to enforce "this panel template wires all four states" without a runtime convention test, which would be brittle. The pragmatic rule is "human review + the validating surface is the worked example."

axe-core stays at WCAG 2.1 AA. No new axe rule is added; the existing tests/e2e/specs/accessibility.spec.ts axe scan continues to cover the validating surface. New panel-states.spec.ts does NOT run axe — it asserts presence + structure of each state.