Version 0.40.1

Started measuring a stricter rule on how code is allowed to run in the page.

This one blocks nothing yet, and saying so is the point: alongside the rule the browser enforces, NMTS now sends a second one marked report-only, so the browser reports what the stricter rule would have stopped and then allows it. That rule refuses to let plain text become executable code, which is the step past what the enforced rule can reach today. Measured across eight screens, including the one where the key-holding worker actually runs: nothing would have been stopped. It stays report-only because the human-check widget, which NMTS does not write and cannot change, does exactly the thing the rule forbids — turning it on today would leave sign-up and sign-in without their human check.