chore(launch-hygiene): pin inline-script CSP hashes (PF-3 was CSP-blocked) + npm ci in the SPA builder
- fix(csp): pin the identity-prefetch inline script hash and re-pin the drifted EmptyRanges shim (PF-3 was CSP-blocked everywhere)
- build(docker): install the SPA deps with
npm ci, notnpm install— builds were not lock-exact - Merge pull request #515 from tpromni/chore/launch-hygiene-csp-hash-npm-ci
Source: tpromni/coach-pulse-consumer-ui → dev