half our failed widget installs were csp headers, not our code

spent two weeks convinced our loader script had a race condition. turned out most of the silent failures were customers on locked down content security policies that blocked our cdn domain, and the browser console error never made it into any bug report because nobody checks console before emailing support. we added a one line check that pings the cdn on load and shows a real message in the container instead of nothing. support volume for install issues dropped off a cliff.