fix: harden Registry links and website build chain

[a19q3]

Summary

• Reject unsafe or credential-bearing Registry links before rendering them.
• Ship a strict production CSP while preserving the existing Google Fonts dependency.
• Pin GitHub Actions, enable Dependabot, and update the Astro/frontend dependency chain.
• Add URL-policy, clean-install, and deployment-contract regression coverage.

Validation

• npm 10.9.8 clean install passed.
• Full npm run build passed.
• Remaining npm advisories are low-severity transitive CKB connector or elliptic findings.