fix(mindspace): guard published pages against blocked CDN scripts

Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP.

Co-authored-by: Cursor <cursoragent@cursor.com>

mindspace-publications.mjs

@@ -2,6 +2,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { localizeGoogleFontsCss } from './mindspace-html-localize.mjs';
+import { rewriteKnownCdnScriptSources } from './mindspace-published-script-localize.mjs';
 import { replacePrivateResourceReferences, scanContent } from './mindspace-content-scan.mjs';
 import { pageInternals, normalizeWorkspaceRelativePath } from './mindspace-pages.mjs';
 import { readWorkspacePublishHtml } from './mindspace-workspace-path.mjs';
@@ -352,6 +353,7 @@ async function prepareHtmlPublishContent({
   h5Root = null,
 }) {
   let publishContent = (await localizeGoogleFontsCss(html)).html;
+  publishContent = rewriteKnownCdnScriptSources(publishContent).html;
   publishContent = replaceImgproxyStandardImageReferences(
     publishContent,
     resolvePublicBaseUrl(),