The zero-JavaScript static site is a defensible choiceNo script-src is not a gap — it is a boundary with a measurable contract.
