validate(no-cdn-refs): file-level allowlist for build-side CDN tooling

Two files in this repo legitimately reference CDN domains as data:
  scripts/walkthrough.mts  — emits SRI + CSP hashes for CDN scripts
  scripts/audit-deps.mts   — scans generated HTML for unpkg specifiers

Both inspect, hash, and rewrite CDN references at build time so the
walkthrough can ship them with integrity + CSP enforcement. The rule's
intent ("no accidental CDN runtime dependencies") doesn't apply — these
are the scanner/rewriter. Move the self-skip into a named ALLOWED_FILES
list and add the two files there.

No behavior change for any file outside the list. The val code, shim
JS/CSS, configs, and tests are still linted as before.

Author: jdalton

scripts/validate/no-cdn-refs.mts

@@ -134,11 +134,24 @@ async function findTextFiles(
 /**
  * Check file contents for CDN references.
  */
+// Files that legitimately reference CDN domains as data (regex
+// patterns, URL-extraction helpers, doc comments explaining which
+// CDN the code is built to handle). These aren't runtime loads — they
+// are the build-side tooling that inspects, fetches, hashes, and
+// rewrites CDN URLs for SRI + CSP enforcement. The validator's intent
+// ("no accidental CDN runtime dependencies") doesn't apply here.
+const ALLOWED_FILES = [
+  /no-cdn-refs\.(m?[jt]s|cjs)$/, // self-skip
+  // Build tooling for the walkthrough pilot — these files enumerate,
+  // fetch, hash, and rewrite CDN references so they can ship with
+  // integrity + CSP hashes. Any CDN reference in them is in the
+  // scanner/rewriter, not a runtime dependency.
+  /scripts[\\/]walkthrough\.mts$/,
+  /scripts[\\/]audit-deps\.mts$/,
+]
+
 async function checkFileForCdnRefs(filePath: string): Promise<CdnViolation[]> {
-  // Skip this validator script itself (it mentions CDN domains by
-  // necessity). Match any module extension — historically this was
-  // .mjs, now it's .mts.
-  if (/no-cdn-refs\.(m?[jt]s|cjs)$/.test(filePath)) {
+  if (ALLOWED_FILES.some(re => re.test(filePath))) {
     return []
   }