CSP 5 — report-only (same policy as page 1)

Nothing is blocked: GA4 fires and Chromium logs report-only violations. Expect csp_report_only_violations (info) and no block or requirement finding.