improve-codebase-architecture: CDN-loaded Tailwind/Mermaid silently breaks the HTML report (SRI hooks, offline envs)

## What happened Ran `/improve-codebase-architecture` in Claude Code. The generated report opened as completely unstyled raw HTML — no Tailwind, no Mermaid rendering. ## Why `HTML-REPORT.md` mandates loading Tailwind and Mermaid from CDNs: ```html import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs"; ... ``` This makes the report fragile in ways the agent can't see (it never renders the page itself): 1. **Security hooks/plugins fight the CDN tags.** My session has a security-guidance hook that flags external scripts without SRI (`integrity="sha384-..."`). The agent dutifully added hashes — but `cdn.tailwindcss.com` (the Play CDN) can serve different bytes to a browser than to the `curl` used to compute the hash, so the browser silently blocks the script and the page renders with zero styling. Failure is invisible until a human opens the file. 2. Offline / restricted-network environments get the same unstyled result. 3. The Tailwind Play CDN is explicitly not for production and its payload can shift under you. ## Suggestion Make the report genuinely self-contained, as the first line of HTML-REPORT.md already promises ("a single self-contained HTML file"): - Drop the Tailwind CDN and have the agent write plain inline CSS (a small token block covers the whole report — the doc already includes a custom ` ` layer anyway; models are good at this). - Mermaid is the harder one; options: keep the CDN but treat diagram rendering as progressive enhancement (hand-built div/SVG diagrams already carry most cards), or note the trade-off in the doc. - Optionally: in Claude Code, publishing via the built-in Artifact tool is a nice fit — its CSP forbids external hosts entirely (so this failure mode can't exist), it renders ` ` natively without any script tag, and the user gets a persistent private URL instead of a temp file. Could be offered as the preferred output when the tool is available, with the temp-file flow as fallback. Happy to PR the HTML-REPORT.md change if you'd take it.