Canvas CSP lab

Same-origin modules and styles under a strict Content-Security-Policy. Hostile trees are rejected by renderer limits before DOM work grows unbounded.