Fix timeline webview CSP blocking data injection ("No timeline data")

[VeryComplexAndLongName]

Summary

• User-reported bug: every timeline webview (single-change and comparison) showed "No timeline data" after installing the real extension.
• Root cause: TimelineWebviewPanel's CSP (script-src ${webview.cspSource}) had no 'unsafe-inline' or nonce, so the browser silently blocked the inline <script> that embeds the fetched data. The bundle's own external <script src=...> tag still matched CSP and ran fine, so the page rendered normally — just with the "no data" fallback — instead of failing loudly.
• Every smoke test performed while building the two prior timeline PRs (Add single-change timeline view (webui + VS Code extension) #92, Add multi-change comparison timeline (log-scale) #93) loaded the built bundle in a bare Playwright page with no CSP at all, which never exercised this code path.
• Fix: a per-panel CSP nonce (not a blanket 'unsafe-inline', which would weaken CSP for every inline script on the page).
• This time, reproduced the exact bug and confirmed the fix using a Playwright test with the real CSP meta tag applied — the gap that let this ship in the first place.

Test plan

• New timeline-panel.test.ts: nonce present in both CSP and inline script tag, 'unsafe-inline' never used, distinct nonce per panel, </script>-injection escaping still holds
• npm run typecheck and npm run test for openspec-ui-vscode; npm run lint (including lint:english) workspace-wide
• npm run package --workspace openspec-ui-vscode — VSIX packages without error
• openspec change validate --strict fix-timeline-webview-csp-inline-script

🤖 Generated with Claude Code