Security: tighten the POST-A/B fixes after re-review (entity-decoded camo decisions, own-host images load directly, own-host checks on verify and redirects, SVG badges kept, targeted 5xx masking, same-site user-content as a warning, per-isolate walk dedupe, plan gate on preview tickets).
11 files changed+92−31
Rendering diff…