audit Run 15 Phase 5: CSP script-src drops 'unsafe-inline'
Surface fragment render errors and de-fragilize two UX sinks (ultra-fuzz Run 12 UX)
ux: extract all executable inline JS from templates into static files