Run Locally: strip crossorigin so CSS loads over file://

Vite stamps crossorigin on the injected <link>/<script>. Over file:// a
crossorigin stylesheet is a CORS request against a null origin with no CORS
headers, so the browser refuses to apply the CSS — the exact "CSS doesn't load
when I open the download" symptom. A post-order transformIndexHtml plugin now
removes the attribute; harmless no-op on the same-origin live site.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: kinlane

vite.config.ts

@@ -4,13 +4,27 @@ import { nodePolyfills } from 'vite-plugin-node-polyfills';
 // Static SPA. Use a RELATIVE base ('./') so the built assets resolve no matter
 // where the app is served from — the custom domain root (validator.apicommons.org)
 // AND an unzipped "Run Locally" copy served from any folder.
+// Strip the `crossorigin` attribute Vite stamps on the injected <link>/<script>
+// tags. On the live (same-origin) site it's a harmless no-op, but when the
+// unzipped "Run Locally" copy is opened over file://, a crossorigin stylesheet is
+// a CORS request against a null origin with no CORS headers — so the browser
+// refuses to apply the CSS. Removing it lets the CSS load from file:// too.
+const stripCrossorigin = {
+  name: 'strip-crossorigin',
+  transformIndexHtml: {
+    order: 'post' as const,
+    handler: (html: string) => html.replace(/\s+crossorigin(=(["'][^"']*["']|\S+))?/g, ''),
+  },
+};
+
 export default defineConfig({
   base: './',
   plugins: [
     nodePolyfills({
-      // The Spotlight (Spectral) engine pulls in a few Node built-ins.
+      // The Spectral engine pulls in a few Node built-ins.
       globals: { process: true, Buffer: true },
     }),
+    stripCrossorigin,
   ],
   worker: { format: 'es' },
   build: { target: 'es2020', sourcemap: false },