Merge remote-tracking branch 'upstream/codex/release-hygiene-ci'

# Conflicts:
#	docs/research/pre_work_error_ledger.md
#	jyotish-app/api-bridge.js
#	mcp_server.py
#	references/technique_registry.json
#	scripts/jyotish_api_server.py
#	scripts/skill_release_package.py

scripts/report_builder.py

@@ -360,6 +360,13 @@ def build_section(num, title, md_text):
 </div>"""
 
 
+def is_allowed_report_resource_url(url, *, report_url):
+    if url == report_url:
+        return True
+    parsed = urlparse(url)
+    return parsed.scheme in {'data', 'about', 'blob'}
+
+
 def _html_to_pdf(html_path, pdf_path):
     """Convert HTML to PDF using Playwright headless Chromium."""
     try:
@@ -372,14 +379,25 @@ def _html_to_pdf(html_path, pdf_path):
     print("  Launching headless Chromium...")
     with sync_playwright() as p:
         browser = p.chromium.launch(headless=True)
-        page = browser.new_page()
-        page.goto(f"file://{os.path.abspath(html_path)}", wait_until="networkidle")
+        context = browser.new_context(java_script_enabled=False)
+        page = context.new_page()
+        report_url = f"file://{os.path.abspath(html_path)}"
+        page.route(
+            "**/*",
+            lambda route: (
+                route.continue_()
+                if is_allowed_report_resource_url(route.request.url, report_url=report_url)
+                else route.abort()
+            ),
+        )
+        page.goto(report_url, wait_until="networkidle")
         page.pdf(
             path=pdf_path,
             format="A4",
             print_background=True,
             margin={"top": "22mm", "bottom": "24mm", "left": "20mm", "right": "20mm"},
         )
+        context.close()
         browser.close()
 
     size_kb = os.path.getsize(pdf_path) / 1024