FORGE-STATIC-E2E-WS5

v6: validates _redirects/_headers (WS5) + injection guard (Fix 3).