[BUG] Brand font validation accepts prohibited fonts when an approved fallback is present

Affected Notebook/File

skills/custom_skills/applying-brand-guidelines/validate_brand.py (BrandValidator.validate_fonts)

Bug Description

A normal CSS font stack such as font-family: Comic Sans MS, sans-serif; passes validation with a score of 100. The validator searches the entire declaration for any approved font substring, so the approved fallback hides the unapproved first-choice font. Papyrus, system-ui also passes.

The skill's SKILL.md explicitly prohibits Comic Sans and Papyrus, and REFERENCE.md requires approved fonts only. A document using either prohibited family should receive a font violation even when its fallback is approved.

Steps to Reproduce

On current main (bfe50e59dbb4f5546a0af9ca36ebb77e637c9ce1), run this from the repository root; it uses only the Python standard library:

import runpy

module = runpy.run_path(
    "skills/custom_skills/applying-brand-guidelines/validate_brand.py"
)
validator = module["BrandValidator"](module["get_acme_corporation_guidelines"]())

for css in (
    "font-family: Segoe UI, sans-serif;",  # approved control
    "font-family: Comic Sans MS;",        # rejected control
    "font-family: Comic Sans MS, sans-serif;",
    "font-family: Papyrus, system-ui;",
):
    result = validator.validate(css)
    print(css, result.passed, result.score, result.violations)

Error Message

There is no exception; these are false successful validations:

font-family: Segoe UI, sans-serif; True 100 []
font-family: Comic Sans MS; False 90 ['Unapproved font used: Comic Sans MS']
font-family: Comic Sans MS, sans-serif; True 100 []
font-family: Papyrus, system-ui; True 100 []

The last two results should fail. Parsing the individual family names and comparing whole normalized names would also avoid accepting arbitrary names containing an approved font name, such as NotSegoe UI.

Environment

Python 3.12.15, macOS 27.0.1 arm64. Reproduced offline without API calls or third-party dependencies.

Would you be willing to submit a PR to fix this?

No, I'm just reporting.