fix(proof): run Axe with CSP enforced

scripts/product-proof-cloud-playwright.mjs

@@ -5660,15 +5660,16 @@ export async function captureProductProofAccessibilityEvidence({
 export async function runProductProofAxeAudit(page, axeSource) {
   if (
     !page ||
-    typeof page.addScriptTag !== 'function' ||
     typeof page.evaluate !== 'function' ||
     typeof axeSource !== 'string' ||
     Buffer.byteLength(axeSource, 'utf8') < 1024 ||
     Buffer.byteLength(axeSource, 'utf8') > 5_242_880
   ) {
     fail('axe_unavailable');
   }
-  await page.addScriptTag({ content: axeSource });
+  // Execute the repository-pinned audit source through Playwright's trusted
+  // evaluation channel so the product CSP remains enforced and unchanged.
+  await page.evaluate(axeSource);
   const result = await page.evaluate(async (sourceOwnedSurfaceLabels) => {
     if (!window.axe || typeof window.axe.run !== 'function') return null;
     if (!Array.isArray(sourceOwnedSurfaceLabels)) return null;

scripts/product-proof-cloud-playwright.test.mjs

@@ -9529,9 +9529,17 @@ test('Axe audit passes zero findings and fails violations/incomplete without DOM
   );
   const source = 'x'.repeat(1024);
   let receivedSurfaceLabels;
+  let evaluationCalls = 0;
   const page = {
-    addScriptTag: async ({ content }) => assert.equal(content.length, 1024),
-    evaluate: async (_callback, surfaceLabels) => {
+    addScriptTag: async () => assert.fail('Axe must not be installed through a CSP-blocked tag'),
+    evaluate: async (callback, surfaceLabels) => {
+      evaluationCalls += 1;
+      if (evaluationCalls === 1) {
+        assert.equal(callback, source);
+        assert.equal(surfaceLabels, undefined);
+        return undefined;
+      }
+      assert.equal(typeof callback, 'function');
       receivedSurfaceLabels = surfaceLabels;
       return {
         incomplete: [],
@@ -9542,6 +9550,7 @@ test('Axe audit passes zero findings and fails violations/incomplete without DOM
     },
   };
   assert.equal((await runProductProofAxeAudit(page, source)).status, 'passed');
+  assert.equal(evaluationCalls, 2);
   assert.deepEqual(receivedSurfaceLabels, PRODUCT_PROOF_AXE_SURFACE_LABELS);
   const violating = {
     ...page,
@@ -9864,10 +9873,17 @@ test('Axe browser classification exposes only fixed nearest Inbox surfaces', asy
       },
     ],
   };
+  let evaluationCalls = 0;
   const page = {
-    addScriptTag: async ({ content }) => assert.equal(content, source),
-    evaluate: async (callback, surfaceLabels) =>
-      runInNewContext(`(${callback.toString()})(surfaceLabels)`, {
+    addScriptTag: async () => assert.fail('Axe must not be installed through a CSP-blocked tag'),
+    evaluate: async (callback, surfaceLabels) => {
+      evaluationCalls += 1;
+      if (evaluationCalls === 1) {
+        assert.equal(callback, source);
+        assert.equal(surfaceLabels, undefined);
+        return undefined;
+      }
+      return runInNewContext(`(${callback.toString()})(surfaceLabels)`, {
         document: {},
         surfaceLabels,
         window: {
@@ -9878,7 +9894,8 @@ test('Axe browser classification exposes only fixed nearest Inbox surfaces', asy
             },
           },
         },
-      }),
+      });
+    },
   };
   let failure;
   try {
@@ -9887,6 +9904,7 @@ test('Axe browser classification exposes only fixed nearest Inbox surfaces', asy
     failure = error;
   }
   assert.equal(failure?.code, 'axe_accessibility_failed');
+  assert.equal(evaluationCalls, 2);
   const normalizedAxeFailure = JSON.parse(
     JSON.stringify(
       createProductProofRouteFailureDiagnostic({