[BarnabyShearer]

Every four-stroke document's Content-Security-Policy now requires Trusted Types:

require-trusted-types-for 'script'; trusted-types four-stroke

The nonce and 'strict-dynamic' already decide which scripts run. Trusted Types close the other way in: every DOM sink that can run code (innerHTML, a script's src, a worker's address) refuses a plain string and takes only what a named policy made. The requirement holds in dev as well, so a hand check under make dev exercises it.

• Apps name their own policies through the existing sources, e.g. { "trusted-types": ["dompurify"] }. Sources are appended as before, so an app can add a policy name but cannot lift the requirement.
• The auth service worker is registered through a four-stroke policy. ServiceWorkerContainer.register is a TrustedScriptURL sink, so whenControlled now builds the address through a policy that makes /auth-service-worker.js and throws on anything else. It is created once per page (a policy name can be created only once), and a browser without Trusted Types gets the plain string.
• The DOM's TypeScript types know no Trusted Types, so a TrustedScriptURL is typed as the string it stands for, and reading globalThis.trustedTypes takes one commented type assertion rather than a new @types/trusted-types dependency.

Follow-ups once this is released (not in this PR):

• referral-engine returns TrustedHTML from DOMPurify for job descriptions and names dompurify in its sources.
• dashboard drops its own ServiceWorkerBridge, whose bare-string register() the policy would refuse; controlledFetch already registers the same worker.
• directory-engine needs only the version bump.

Releasing this before referral-engine's change lands would break job descriptions that carry HTML, so the bumps and that change go together.

🤖 Generated with Claude Code