Blueprint runtime — no eval, under a strict CSP

This page runs the actual contract validator (@dashforge/blueprint-core + zod, jitless) under the policy below. No 'unsafe-eval'.

Content-Security-Policy: default-src 'self'; script-src 'unsafe-inline'; base-uri 'none'

running…