[mobile][W0] Compact one-line cookie consent bar (site-wide)

[jasonhnd]

Context (read this first)

• Repo: jasonhnd/jobs → mirai-shigoto.com. JA-only static Astro site, 91% mobile sessions.
• Base branch is preview. Your PR targets preview. NEVER push, merge, or open a PR to main. Never trigger a production deploy. The owner reviews the finished state on preview and personally decides promotion.
• Referee spec: docs/MOBILE_SHAPES.md — read §0 (process gates), §3 (global invariants), §3.4 (this issue's spec) before coding.
• Visual reference: bottom edge of mockups/shots/frame-02.png (compact bar) vs mockups/shots/live-ranking.png (current banner covering ~1/3 of the first screen).

Problem

On first visit the cookie consent banner (#cookieBanner in src/layouts/BaseLayout.astro) covers roughly the bottom third of every mobile first screen, including the thumb zone.

Scope

• src/layouts/BaseLayout.astro (banner markup/CSS)
• src/lib/canonical-css.ts (if banner styles live there)

Spec

Presentation-only change:

1. Single sticky bottom bar, total height ≤48px + env(safe-area-inset-bottom).
2. Content in one line: text 解析のためCookieを使用します。 + link 詳細 → /privacy + right-aligned buttons 拒否する (ghost) and 同意する (accent --accent / #D96B3D bg).
3. Keep byte-identical: element ids cookieBanner / cookieReject / cookieAccept, button label strings, and the entire consent inline <script> body (it is CSP-hashed — see §3.6). Only surrounding markup text and CSS change.
4. Text ≥12px (§3.1). Buttons ≥44px hit area (§3.2) — padding may extend the hit area beyond the visual pill.
5. Long-text overflow: the sentence must fit one line at 390px; if a locale/font edge case wraps, the bar may grow to two lines — never overlap content interactivity.

Out of scope

Consent logic, GA4 consent mode wiring, Meta/X pixel lazy-init, banner show/hide conditions — all unchanged.

Acceptance

• 390×844 screenshot in PR: first visit on /rankings/ai-risk-high shows the bar ≤48px tall, both buttons visible and tappable.
• Desktop ≥1280px screenshot: bar unobtrusive, no layout break.
• bun run typecheck && bun run test && bun run verify:gates && bun run test:e2e green; bun run check:csp-hashes proves no hash change (script untouched).
• Accept/Reject still write localStorage.cookieConsent and fire the same consent update (manually verify once, note in PR).