I run AI Change Watch , a small independent project that crawls what 15 AI vendors publish about their own models — deprecation tables, lifecycle pages, pricing and SDK releases — and records every time one of them changes. At some point I added a Content-Security-Policy. It was correct. It shipped. Production was fine. And then, locally, every interactive thing on the site stopped working. The symptom next dev starts. The page loads. It looks exactly right — the la...