fix(pow): support strict CSP without unsafe-eval

[edgepillar]

Summary

• rebuild the PoW glue with dynamic JavaScript execution disabled and Embind AOT enabled
• replace the Node new Function(...import...) shim and browser inline module script with native dynamic imports
• pin the PoW source and Emscripten version for reproducible assets
• add regression coverage and document the exact browser CSP requirements

Scope

This is limited to the existing PoW loader, generated JS/WASM assets, build script, tests, and documentation. It does not change the PoW algorithm, wire format, or public transaction API.

The resulting browser policy can use:

script-src 'self' 'wasm-unsafe-eval';
worker-src 'self' blob:

The generated PoW loader no longer requires 'unsafe-eval'. The narrower 'wasm-unsafe-eval' permission is still required for WebAssembly compilation in Chromium.

Reproducibility

• PoW source: zenon-network/znn-pow-links-cpp@9c63abdcd4e6bd642a81476cbff2f5190efabe95
• Emscripten: 6.0.8
• flags: DYNAMIC_EXECUTION=0, EMBIND_AOT=1
• the build now fails if generated pow.js contains eval() or new Function()

Validation

• npm run build:wasm
• npm test on Node 20.20.2 and 22.23.2 — 650 passing on each
• npm run lint — 0 errors
• npm run build
• npm pack --dry-run --ignore-scripts
• compiled Node PoW initialization and nonce generation
• Chromium runtime checks for direct and SDK-integrated main-thread and worker paths, with zero CSP violations
• negative Chromium control without 'wasm-unsafe-eval', which failed only at WebAssembly compilation as expected

Opening as a Draft for maintainer feedback on the CSP approach and reproducible toolchain pin.