fix(brief,variant,map): triage live breakage regressions (#3917)

* fix live breakage triage regressions

* fix(csp): allow variant bootstrap script

* fix(csp): mirror variant-bootstrap sha256 into vercel.json header

The variant inline-bootstrap script in index.html now detects commodity.
and energy. hosts; its sha256 was added to the index.html meta CSP but
not to the vercel.json response-header CSP. WM enforces both CSPs
concurrently, so the script was blocked at the Vercel edge and
tests/deploy-config.test.mjs:263 failed in CI.

* fix(csp): mirror variant-bootstrap sha256 into docker/nginx-security-headers.conf

Third CSP surface — main added a deploy-config test
(tests/deploy-config.test.mjs:324) that asserts vercel.json's script-src
hashes are also mirrored in the self-hosted docker nginx config. The
variant-bootstrap sha256 was added to index.html (commit c50e53f83) and
vercel.json (commit ea3dafd0c) but not to the nginx config.

After rebase onto origin/main, this commit adds the missing hash to the
self-hosted CSP. All three surfaces (meta tag, Vercel header, docker
nginx) now carry the same five sha256 entries.