Fix HTMX inline-style CSP and Prism worker parsing

Why

Two browser errors broke syntax highlighting and violated the CSP:

• HTMX injects a <style> element for its indicator classes, which style-src 'self' blocks.
• Prism installs its own worker message handler that calls JSON.parse(event.data), but prism-worker.js posts structured objects. Every highlight job logged SyntaxError: JSON.parse: unexpected character before the worker’s own handler ran.

What changed

• Added an htmx-config meta tag that sets includeIndicatorStyles: false.
• Moved HTMX’s indicator rules into vole.css, so the stylesheet remains the only style source.
• Set disableWorkerMessageHandler: true on Prism in prism-worker.js; the worker already owns its message path.
• Added regression tests for both fixes.

Verification

• vole workflow check
• vole workflow run verify (format, vet, build, govulncheck, packaging, links, race tests)
• go test ./... -count=1