fix(i18n): ship i18n data as a JSON block so CSP cannot block it

window.__wrnI18n was undefined in development: the payload shipped as an
executable inline script, and a document's CSP nonce is fixed at load, so
any such script arriving from a later response is blocked. Client
translations and language switching silently had no data.

The payload is now a type="application/json" block, which the browser
never executes and script-src therefore never applies to. The i18n
runtime, CSR navigation, and HMR all read the block instead of matching
window.__wrnI18n= with a regex.

Pages now render zero executable inline scripts, so an inline script-src
violation is structurally impossible rather than merely unobserved. Zero
framework JavaScript on island-free routes is unaffected: the block is
inert data, and nothing loads to read it unless the page needs it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/validate-0.8.mjs

@@ -145,7 +145,7 @@ check(
 );
 check(
   "i18n runtime data is injected into rendered documents",
-  has("packages/dev-server/src/runtime.ts", "renderI18nData(deps.i18n, language)") &&
+  has("packages/dev-server/src/runtime.ts", "renderI18nDataTag(deps.i18n, language)") &&
     has("packages/dev-server/src/runtime.ts", "deps.i18n.cookie.name"),
 );
 check(