CSP policies regress silently — someone adds 'unsafe-inline' to unblock a widget and nobody notices until an XSS report lands. Here's how to make CI catch it, why the gate exits 3 instead of 2, and what to actually gate on so the check survives contact with a real team.