fix: harden prerender publication boundary

tests/unit/metadata.test.ts

@@ -95,7 +95,8 @@ describe('environment-aware crawl and response artifacts', () => {
   });
 
   it('generates production-only sitemap, allow policy, HSTS, and no preview directives', () => {
-    const artifacts = createStaticHostArtifacts(createPageMetadata(content, manifest, productionSite), productionSite);
+    const metadata = createPageMetadata(content, manifest, productionSite);
+    const artifacts = createStaticHostArtifacts(metadata, productionSite);
 
     expect(artifacts.robots).toBe(
       'User-agent: *\nAllow: /\nSitemap: https://portfolio.example.test/sitemap.xml\n',
@@ -104,6 +105,20 @@ describe('environment-aware crawl and response artifacts', () => {
     expect(artifacts.headers).toContain('Strict-Transport-Security: max-age=31536000');
     expect(artifacts.headers).not.toContain('X-Robots-Tag');
     expect(artifacts.headers).not.toContain('private, no-store');
+    expect(artifacts.headers).toBe([
+      '/assets/*',
+      '  Cache-Control: public, max-age=31536000, immutable',
+      '',
+      '/*',
+      `  Content-Security-Policy: default-src 'self'; script-src 'self' '${metadata.jsonLdCspHash}'; style-src 'self'; img-src 'self'; media-src 'self'; font-src 'self'; connect-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; upgrade-insecure-requests`,
+      '  X-Content-Type-Options: nosniff',
+      '  Referrer-Policy: no-referrer',
+      '  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=()',
+      '  X-Frame-Options: DENY',
+      '  Cache-Control: public, max-age=0, must-revalidate',
+      '  Strict-Transport-Security: max-age=31536000',
+      '',
+    ].join('\n'));
   });
 
   it('emits the least-privilege browser security baseline', () => {