fix(deploy): allow WebContainer CDN import and enable cross-origin isolation

The Cloudflare Pages CSP blocked the dynamic import of
@webcontainer/api from cdn.jsdelivr.net in wc-bridge.js, silently
breaking terminal creation in the deployed web build. Whitelist the
CDN in script-src and add COEP so WebContainer boots with full
require-corp isolation instead of falling back to degraded mode.

Author: aaqaishtyaq

scripts/deploy-cloudflare.sh

@@ -234,6 +234,7 @@ cat > "${STAGE}/_headers" <<'EOF'
   X-Content-Type-Options: nosniff
   Referrer-Policy: no-referrer
   Cross-Origin-Opener-Policy: same-origin-allow-popups
+  Cross-Origin-Embedder-Policy: credentialless
   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https: wss: blob:; worker-src 'self' blob:; frame-src 'self' https:; object-src 'none'; base-uri 'self'
 
 /vscode/*