CHANGELOG: document the style-src CSP fix

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01DY9UMTuF43Ekc2U4E1eDwX

CHANGELOG.md

@@ -19,3 +19,19 @@ would plausibly want. Newest first.
   **Re-vendor if:** your site uses the default built-in relay list (i.e. you
   don't pass your own `vault-relays`/`discovery-relays` attributes). If you
   already pass your own relay list, this doesn't affect you.
+
+- **Fix: widget completely unstyled (giant logo, unstyled buttons) under a
+  strict `style-src` CSP.** `element.ts` injected its CSS as an inline
+  `<style>` tag inside the shadow root on every render. A host with
+  `style-src 'self'` and no `'unsafe-inline'` silently drops an inline
+  `<style>`'s rules entirely — visible as the brand SVG rendering at its raw
+  ~590×119px intrinsic size instead of the intended 20px-tall lockup, with
+  every other shadow-DOM element similarly falling back to unstyled browser
+  defaults. Switched to building the stylesheet once as a `CSSStyleSheet` and
+  assigning it via `adoptedStyleSheets`, which isn't subject to `style-src`.
+  (`e8712f9`)
+  **Re-vendor if:** your site's CSP sets `style-src` without `'unsafe-inline'`
+  (check your CSP header/meta tag). If your `style-src` already includes
+  `'unsafe-inline'`, or you have no CSP, this was invisible to you either
+  way, but re-vendoring is still a good idea (this fix also drops needless
+  per-render CSS reparsing).