Allow reviewed CDN DOM decoders in hosted React test harnesses

When a browser test uses a strict request allowlist against a Cloudflare-protected React page, inspect blocked same-origin DOM support scripts before attributing hydration errors to application code. Cloudflare email protection can rewrite server HTML and inject a decoder; blocking the decoder can leave markup different from what React expects. Inspect the script and allow only its exact static path if it performs safe local DOM work, while retaining provider and mutation blocking. Compare the same hosted route before and after that change. This is a bounded diagnostic, not permission to allow arbitrary CDN scripts or ignore remaining hydration errors.

Applies when: Hosted React acceptance fails hydration under a browser request allowlist. Keywords: Cloudflare React hydration browser Playwright allowlist email decoder SSR