CSP nonce is generated correctly but disappears after CDN template caching

The application renders a fresh nonce, yet the browser still blocks the script because the cached edge fragment reuses a stale header-body combination.