deploy(hf): sync szl-holdings/a11oy@main derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy main.
Files: 1053 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

web/verify-receipt.html

@@ -282,10 +282,17 @@
     var q = new URLSearchParams(window.location.search);
     var receipt = q.get("receipt");
     var envelope = q.get("envelope");
-    if(envelope){
+    // Validate the SHAPE of the URL-supplied values before they drive the
+    // auto-verify branch. The server does the real cryptographic verification;
+    // this is defence-in-depth so a malformed/oversized query param is never
+    // blindly re-submitted, and it takes the raw user-controlled value out of
+    // the security-relevant branch condition (CodeQL js/user-controlled-bypass).
+    var validEnvelope = typeof envelope === "string" && /^[A-Za-z0-9_\-]{1,8192}$/.test(envelope);
+    var validReceipt  = typeof receipt  === "string" && /^[A-Za-z0-9._:\-]{1,256}$/.test(receipt);
+    if(validEnvelope){
       $("env").value = envelope;
       doVerify({envelope: envelope});
-    } else if(receipt){
+    } else if(validReceipt){
       $("rid").value = receipt;
       doVerify({receipt_id: receipt});
     }