test: clear non-production CodeQL findings

[neonwatty]

Summary

• replace the incomplete Google Fonts substring filter with exact parsed-host matching
• exclude only frozen legacy compatibility fixtures from JavaScript CodeQL analysis
• lock both behaviors with adversarial unit and workflow mutation tests

Why the exclusion is narrow

The remaining DOM XSS result is in an immutable historical widget fixture used for compatibility testing. Editing it would invalidate the fixture. The CodeQL config excludes only test/fixtures/legacy-compat/**; a repository guard rejects broader exclusions.

Validation

• make check
• npm test — 70 files, 990 tests
• npx vitest run test/liveConsoleErrors.test.ts — 9 tests
• bash test/security-analysis-workflows.test.sh
• actionlint .github/workflows/codeql.yml
• independent correctness, tests, contracts, and simplification reviews: no findings

The first full test attempt had three 5-second timeouts in retention-integration.test.ts; that file passed 8/8 in isolation and the repeated full suite passed 990/990.