hf-sync: mirror front-door from GitHub bc6b785b

Add evidence-bound Anatomy capability surface (#1)

fix(csp): allow a-11-oy.com / a11oy.net to embed the anatomy — lockstep with szl-holdings/anatomy PR #29 (server.py is not in hf-sync's mirror set)

deploy: add GET /healthz route so fleet monitor sees anatomy healthy

fix: allow huggingface.co to frame the Space (App-tab embed was blocked by frame-ancestors 'self')

harden(anatomy): add CSP/HSTS/nosniff/Referrer + clean Server banner via server.py; preserve COOP/CORP; same files/port (non-breaking)