Fix CSP for Astro islands and navbar background

Astro emits inline <script type="module"> bootstrap blocks for each
client:* directive (trailer audio button, council preview button).
The strict script-src 'self' CSP blocked them, so islands never
hydrated and audio buttons did nothing. Adding 'unsafe-inline' to
script-src is the time-pressure unblock; a proper Astro CSP
integration that auto-hashes inline scripts is a follow-up.

Navbar background: .pub-navbar in public-layout.css only sets sticky
positioning, no background or blur. The sticky bar showed through to
page content on scroll, leaving nav links overlapping prose. Same
cosmic blue + blur as .pub-cta--sticky for visual consistency, added
as a scoped is:global block in marketing/src/components/Navbar.astro
so the frozen public-layout.css stays untouched.

Both fixes are already live on production via wrangler direct deploy
(d6c829a5.agora-cosmica.pages.dev). This commit brings GitHub in sync
so CF Pages auto-builds and GitHub Actions CI rebuild against matching
source.

Author: michael-chipmates

client/public/_headers

@@ -5,7 +5,7 @@
   Referrer-Policy: strict-origin-when-cross-origin
   Permissions-Policy: camera=(), microphone=(self), geolocation=()
   Strict-Transport-Security: max-age=31536000; includeSubDomains
-  Content-Security-Policy: default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.agoracosmica.org; font-src 'self'; connect-src 'self' blob: https://openrouter.ai https://*.agoracosmica.org wss://*.agoracosmica.org; media-src 'self' blob: https://*.agoracosmica.org; frame-src https://challenges.cloudflare.com; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.agoracosmica.org; font-src 'self'; connect-src 'self' blob: https://openrouter.ai https://*.agoracosmica.org wss://*.agoracosmica.org; media-src 'self' blob: https://*.agoracosmica.org; frame-src https://challenges.cloudflare.com; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
 
 # Immutable cache for hashed assets (Vite adds content hash to filenames)
 /assets/*

marketing/src/components/Navbar.astro

@@ -71,3 +71,15 @@ const isActive = (path: string) => currentPath === path || currentPath === path.
     </button>
   </div>
 </header>
+
+<style is:global>
+  /* Bug fix: .pub-navbar had no background in public-layout.css, so the
+     sticky bar showed through to page content on scroll. Same cosmic blue
+     + blur as .pub-cta--sticky for visual consistency. */
+  .pub-navbar {
+    background: color-mix(in srgb, var(--bg-deep-space, #0C1133) 92%, transparent);
+    backdrop-filter: blur(12px);
+    -webkit-backdrop-filter: blur(12px);
+    border-bottom: 1px solid color-mix(in srgb, var(--gold-primary) 16%, transparent);
+  }
+</style>