web: vendor the Keep the Why views library (pinned release, hashes, update PR, CSP check) — KTW M1

tsk-5tcq1t2vhh56 open

From ktw-head via maity-ktw-integrator (seq 41119), on Oliver's request; scope: public projects only (Oliver, seq 39334).

vendor_ktw.py: fetch exactly the files ktw-views.json lists from a pinned KTW release asset, verify hashes, write them under the web static dir; refuse anything else.
A scheduled workflow opens an update PR on a new KTW release (version, hashes, changelog link).
A check.py target in CI: no eval/Function/innerHTML/inline style=; files and hashes match the manifest; pages load under default-src 'self'.
Licence and origin of the vendored files stated; a context/ entry for vendoring vs. a package dependency.

Files: web/tools/vendor_ktw.py, web/tools/check.py, .github/workflows/, web/context/.