The list-separator arm of the tracker rules reads a digit-only CSS colour after a comma as an issue reference

[HackingGate]

What happened

Since #192 (1.19.0) the bare-number arm of no-task-tracker-references
and no-task-tracker-references-in-code admits a hash number after a
list separator: [,;/][\t ]*#[0-9]+\b. A consumer's stylesheet line

.a { color: color-mix(in srgb, #000 20%, white); }

is now refused by the code-scoped rule, reproduced in a throwaway
repository inheriting code-residue alone. #000, #111 and #000000
after a comma in CSS, SCSS or Less are colours; \b after the digits
does not exclude them, because a space follows. The consumer restored its
tree with an [override.no-task-tracker-references-in-code] that adds
*.css to the excludes.

Why

The expression is in policy/base/process-residue.toml and duplicated,
arm for arm, in policy/base/code-residue.toml. #192's body says the
digits "still end at a word boundary, so a colour, a unit and a heading
level stay unmatched", and the corpus in tests/base_set_corpus.rs
proves it with color: #fff under TRACKER_ALLOWS -- a colour whose hex
has no digits, which no arm could match. A colour written in digits, in
a comma-separated argument list, meets the new separator arm exactly.
The code-scoped rule is where it lands: its excludes in code-residue
are the three documentation globs and the test directories, so every
tracked stylesheet is under it.

What would close it

Exclude the stylesheet globs (*.css, *.scss, *.sass, *.less,
*.styl) from no-task-tracker-references-in-code by default, and/or
refuse to read # followed by exactly three or six hex digits as a
reference when the next non-space character is ), ;, , or %.
Corpus cases under TRACKER_ALLOWS for
color-mix(in srgb, #000 20%) and under TRACKER_REFUSES for
Fixed in #100, #200., so the two rules stay held to the same samples.