csp: drop frame-ancestors from meta — browsers ignore it when meta-delivered

Chrome/Firefox only enforce `frame-ancestors` from the response HTTP
header, not from <meta http-equiv>. Emitting it via meta produces a
console warning and no actual protection. Same constraint applies to
`sandbox` and `report-uri` — they need real HTTP headers.

Our GH Pages deploy has no way to set response headers per page, so we
get neither the directive nor a warning we can act on. Drop it. If we
ever move to a host that can set headers (Cloudflare Workers, Netlify
_headers, Val Town routing), re-add as a real HTTP header.

All other directives (default-src, script-src, style-src, img-src,
connect-src, worker-src, base-uri, form-action) stay — those ARE
honored from <meta http-equiv>.

Author: jdalton

scripts/walkthrough.mts

@@ -220,6 +220,14 @@ function buildCspMeta(html: string, commentBackend: string): string {
     const origin = new URL(commentBackend).origin
     connectSources.push(origin)
   }
+  // Note: `frame-ancestors` and `sandbox` are ignored when CSP is
+  // delivered via <meta http-equiv> (spec-level — browsers may have
+  // already begun rendering a framed page by the time they parse
+  // meta tags). We'd get a console warning for emitting them here,
+  // with no actual clickjacking protection to show for it. When/if
+  // this deploy moves to a host that can set response headers
+  // (Cloudflare Workers, Netlify `_headers`, Val Town routing),
+  // add `frame-ancestors 'none'` as a real HTTP header.
   const directives = [
     `default-src 'self'`,
     `script-src ${scriptSources.join(' ')}`,
@@ -229,7 +237,6 @@ function buildCspMeta(html: string, commentBackend: string): string {
     `worker-src 'self'`,
     `base-uri 'self'`,
     `form-action 'self'`,
-    `frame-ancestors 'none'`,
   ]
   const content = directives.join('; ')
   return `<meta http-equiv="Content-Security-Policy" content="${content}" />`