fix(renderer): ship theme scripts as files; render_page names broken surfaces and blocked scripts - #120

What

Theme scripts were blocked on deployed sites, and render_page did not notice.

• Inline theme scripts. Astro inlines a component <script> under build.assetsInlineLimit (4 KB) into the page, and the Site Worker's script-src 'self' blocks it. The cloudhal() integration now sets vite.build.assetsInlineLimit to scriptsNotInlined(…) (csp.ts): script chunks never inline, and other assets keep the project's own limit (number or function). This is cloudhal-dev/cloudhal.com PR chore(deps): Bump the better-auth group across 1 directory with 6 updates #11's workaround, moved into the integration.
• cloudhal dev sends SITE_CSP as Content-Security-Policy-Report-Only on HTML pages without their own policy (new csp-middleware). The console shows what a deploy would block, and Vite's dev client keeps working. The dev-only middleware list moved into DEV_MIDDLEWARE; that keeps cloudhal() inside the size ratchet, whose baseline is updated.
• render_page / cloudhal render gain two checks:
  • surface-broken: a body ```surface fence the preview cannot draw (.ch-surface-problem, with its problems), or a component with an unknown block type or props that do not fit. Theme blocks the preview leaves to the site are not flagged.
  • script-blocked: a script the page's CSP refused, inline (with a sample and line) or by URL, named with its directive. A listener is registered through Page.addScriptToEvaluateOnNewDocument before the page's own scripts run. Report-only violations (cloudhal dev) are reported as "would be blocked on the site". Static previews, which run no scripts on purpose, are skipped.
• RFC-0021's check table lists both.

Tests: astro-renderer/test/csp.test.ts (the inline-limit function, the integration's Vite config on top of a project limit, the dev middleware). cli/test/render-chrome.test.ts covers both checks in Chrome: an enforced meta CSP, and a report-only header served over HTTP.

Checklist

• pnpm check passes locally (see below)
• Contract change? No
• Changeset added (@cloudhal/astro-renderer, @cloudhal/mcp-server, @cloudhal/cli patch)
• Commits are signed off
• Docs updated (RFC-0021 check table)

Verified on a local merge of all three gap PRs (fix/collection-index-page, fix/theme-scripts-csp, fix/body-blocks-and-tools; they merge cleanly): Biome, size check, font-fallback and MCP-doc checks, every typecheck, and every package test suite pass, including @cloudhal/cli (45 files, Chrome render tests included). One exception, not from this change: 35 tests in core-ts store.test.ts on the "Durable Object SQLite (Miniflare)" backend fail with connect EADDRNOTAVAIL (local port exhaustion). main fails the same 35 tests on this machine. No Rust or contract change, so cargo test was not run. GitHub Actions runners do not start (billing), so CI red is environmental.

🤖 Generated with Claude Code