Negative control (deliberately bad). Served with script-src 'self', so its inline script is a policy violation the harness must report.