[osiewicz]

Summary

• generate a restrictive per-page Content Security Policy with Astro
• set an explicit strict-origin-when-cross-origin referrer policy
• replace the docs search inline submit handler so scripts remain hash-restricted
• allow only the external image origins currently used by the site

GitHub Pages does not support custom response headers, so this intentionally uses CSP and referrer meta policies. X-Frame-Options and CSP frame-ancestors are omitted because browsers require those protections to be delivered as HTTP headers.

Verification

• npm run build
• verified all 15 generated HTML pages contain CSP and referrer policies
• verified every inline script and style element has a matching SHA-256 CSP hash
• verified generated pages contain no inline event handlers