APP-21218 Harden docs search against XSS

[clavi-bot]

Summary

• Pin MkDocs Material 9.7.7, whose URL-driven search suggestions render query fragments with textContent instead of innerHTML.
• Add a restrictive generated-page CSP that disallows arbitrary inline scripts and object embeds while retaining audited site integrations.
• Add CI regression coverage that inspects Material's search source and audits CSP placement, script origins, and inline-script hashes on every generated page.
• Migrate the deprecated analytics configuration while upgrading MkDocs.

Validation

• python -m unittest discover -s tests -v (Python 3.13): 2 tests passed.
• python -m mkdocs build --site-dir /tmp/app21218-docs-build-final: passed.
• git diff --check: passed.
• mkdocs build --strict reaches a complete build and aborts only for two pre-existing broken-link warnings in gateway.md and web-traffic.md.
• No treefmt configuration exists in this repository or its checkout ancestors.

Scope

• This is the remaining docs-search XSS/CSP portion of APP-21218.
• The API CORS portion was already human-merged separately in scarf-sh/repo#10308 and is not duplicated here.

Remaining risk

• CSP hashes intentionally make future generated inline-script changes fail CI until explicitly audited and added to the policy.

AI-generated by OpenClaw/Codex GPT-5 implementation lane for APP-21218.