Sitesmith capture: CSS judged via CSSOM (no regex), single URL gate (no % / dot segments / backslash), all resources inlined through a bounded no-credentials fetch, CSP img-src data: only; bypass-class proof tests (unit + Firefox/Chromium)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

craft/scripts/e2e-capture-security-entry.ts

@@ -1,13 +1,13 @@
 // Bundled by scripts/e2e-capture-security.mjs and run in real Firefox + Chromium.
 import { captureHtml } from '../src/utils/self-review-capture';
-import { captureCsp } from '../src/utils/sanitize-capture-html';
+import { CAPTURE_CSP } from '../src/utils/sanitize-capture-html';
 
 (window as any).captureHtml = captureHtml;
 /** Defence-in-depth probe: the capture frame WITHOUT the sanitiser (sandbox + CSP only). */
 (window as any).rawFrame = (html: string) => new Promise<void>((resolve) => {
   const f = document.createElement('iframe');
   f.setAttribute('sandbox', 'allow-same-origin');
-  const CSP = captureCsp(location.origin);
+  const CSP = CAPTURE_CSP;
   f.setAttribute('csp', CSP);
   f.style.cssText = 'position:fixed;left:-9999px;width:800px;height:600px';
   f.addEventListener('load', () => setTimeout(resolve, 800), { once: true });