Same-origin navigation requests

Validate before fetching

Enhanced-navigation document requests now explicitly require the current origin before fetch. Foreign hosts, protocols and ports are rejected without issuing a request.

Preserve ordinary navigation

Same-origin requests retain their abort signal, HTML accept header and manual redirect handling. Existing native anchor eligibility, response validation, layout ownership and fallback behavior remain intact.

Measure the output change

The guard adds 88 raw bytes to the Project application's shared navigation output. Its exact fixture sizes and deployment hash are updated after verification; existing gzip tolerances remain unchanged, and the static Help page remains JavaScript-free.

This release merges PR #5 and its CI baseline correction. It strengthens a browser request boundary without adding a router or a migration capability. create-kudzu 0.1.157 remains compatible.