Close live integrity and browser privacy drift

[chasebryan]

Summary

• bind gzip measurement to the pinned Node/npm verifier and run that verifier before every public live check
• preserve raw-byte and hard-budget enforcement with cross-gzip regression coverage
• remove Pages NEL/Report-To through exact source and account-control contracts
• make every Bottle live probe use a browser user-agent so client-selective transformations are visible
• require no-transform on Bottle static and API responses and reject injected analytics markup or byte drift
• record Cloudflare Web Analytics as disabled for nosuchmachine.net

Validation

• make live-integrity-test repository-maintenance-test site-validate
• pinned Node 22.23.1/npm 11.8.0 npm run check: 14 files / 87 tests, production build, bundle verification, Wrangler dry-run
• host-default Node 24 correctly fails the production verifier gate
• real Firefox: canonical site and Bottle load with same-origin resources only; required Bottle warnings render; no analytics markup or console violation after RUM disablement
• browser-UA Bottle HTML readback is byte-identical to the deployed reviewed index
• canonical root, CSS, and 404 contain neither NEL nor Report-To

This is source-only. It contains no ISO, APK, generated release evidence, private key, plaintext, or other binary release artifact.