Running script-src 'none' while still shipping JSON-LD works because non-JavaScript script types are inert data blocks, which is a detail many people get wrong. Since a CDN-injected beacon was discovered by the browser refusing it, adding report-to or report-uri on the policy would surface blocked injections automatically instead of by accident. For the sandboxed iframe widget, the host pages control embedding only if your widget responses send a suitable frame-ancestors, so it is worth deciding whether that should be an allowlist or open. Does the GET-form calculator also get rate limiting at the Pages Function, since every input combination is now a cacheable URL that can be enumerated?