FORGE-STATIC-E2E-WS5
v6: validates _redirects/_headers (WS5) + injection guard (Fix 3).