[alpha_factory] Fix insight docs asset and service worker regressions

[MontrealAI]

Motivation

• Restore the docs gallery and security contracts that were failing CI by ensuring the Insight demo page exposes the mirrored preview asset and registers its service worker.
• Ensure the page's Content-Security-Policy includes the hash for the new inline service-worker registration so CSP validation passes.

Description

• Added the mirrored preview asset at docs/alpha_agi_insight_v1/assets/preview.svg required by gallery contract tests.
• Restored service-worker registration by injecting an inline registration snippet into docs/alpha_agi_insight_v1/index.html.
• Updated the CSP script-src meta in docs/alpha_agi_insight_v1/index.html to include the new inline script's sha384 hash.

Testing

• Ran python -m pytest -q tests/test_docs_service_worker_present.py tests/test_verify_gallery_assets.py and the suite passed.
• Ran python -m pytest -q tests/security/test_csp.py tests/test_docs_service_worker_present.py tests/test_verify_gallery_assets.py and the suite passed.
• A full python -m pytest -q run initially surfaced the failing docs/CSP checks before the fixes, and targeted suites were rerun after fixes to confirm resolution.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 486735e040

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove unguarded service-worker registration

This inline navigator.serviceWorker.register('service-worker.js') call bypasses the existing guarded registration path in bootstrap.js (which checks !navigator.webdriver and verifies window.SW_HASH before registering). Because this runs unconditionally whenever service workers are supported, a worker can be registered even in contexts the guard was meant to skip or when the hash-verified path would reject it, undermining the integrity and test-safety behavior already implemented.

Useful? React with 👍 / 👎.