[AstroMyth101]

Security changes

• Override transitive sharp to 0.35.5 and regenerate npm package-lock.json, preserving existing npm-only deployment.
• Externalize early theme script and enforce script-src 'self' without 'unsafe-inline'.
• No changes to the default branch.

Verified

• npm ci and npm run build passed with updated lockfile.
• Audited dependencies in GitHub Actions runner — 13 advisories remain (10 high, 3 moderate, 0 critical); none identified for Sharp. Affected dependency names: @11ty/eleventy, @11ty/eleventy-dev-server, @11ty/eleventy-img, argparse, brace-expansion, braces, chokidar, image-size, js-yaml, liquidjs, markdown-it, nunjucks, sprintf-js. These require separate targeted upgrades and threat-model review rather than a blind npm audit fix --force.
• Headless Chromium smoke test: built site served over localhost, DOM contained initialized js class and data-theme, theme-color and toggle present, theme-init asset available. No matching JS/CSP failures in captured browser stderr. Validation run.
• Temporary audit/Chromium steps removed; exact original CI workflow restored in f9f35762693fb94d857bc4acf4f1a26c82299cfe.
• Original CI restored; final clean npm ci and npm run build passed on cleanup commit 09512b6, run 38283734463.
• Interactive Playwright regression suite: 12 passed / 0 failed on run 38283537982. Covered theme switching, persistence, system preferences, CSP inline-script blocking and violation event, navigation, canvas initialization, 14 decoded images across five routes (AVIF/WebP), and absence of unexpected page/request errors. Scope limits: no direct first-paint flash measurement or visual canvas animation comparison. Temporary harness and workflow modifications removed.

Separate dependency investigation

• Audit recorded 13 affected entries (10 high, 3 moderate). Some are inherited parent warnings, not 13 independent vulnerabilities.
• Relevant chains include Eleventy -> chokidar -> braces; Eleventy Image -> image-size; gray-matter -> legacy js-yaml -> argparse -> sprintf-js; and template/markdown build-time dependencies.
• Avoid npm audit fix --force in this security PR. Review patched dependency versions and their compatibility in a separate follow-up change. Static site has reduced runtime exposure, but CI that processes untrusted source/images remains in scope.

Merge gate

Remain draft, unmerged, pending explicit approval. Residual advisories are not claimed resolved. Original Jules PRs #28/#31 superseded by this npm-compatible implementation; #27/#30 independent.