cb test host: strict CSP + Trusted Types

CSP: default-src 'self'; script-src 'self' https://cb-widget.pages.dev; frame-src https://cb-widget.pages.dev; require-trusted-types-for 'script'; trusted-types 'none'. The only widget-related entries are the loader origin in script-src and frame-src.

EfxChat.open() EfxChat.close() Simulate SPA navigation

Unread reported by widget: 0

Violations seen by this host

(none)