docs(csp): record why hermes, homeassistant and litellm allow unsafe-inline

Three roles set unsafe-inline without the rationale the repository lint
requires; 70 roles already carry it.

Only one of the three rationales is a justification. homeassistant's
frontend boots its panel from an inline module script, so the dashboard
stays blank without the flag. hermes and litellm state instead that the flag
was set when the role first deployed with no console error recorded against
it, and carry a TODO to re-verify against the running application and drop it
if nothing breaks.

unsafe-inline weakens the policy against inline script injection. For two of
these roles this documents the exemption rather than justifying it; whether
they work without it has not been tested.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-hermes/meta/csp.yml

@@ -1,7 +1,7 @@
 ---
 flags:
   script-src-elem:
-    unsafe-inline: true
+    unsafe-inline: true # nocheck: csp-unsafe  Reason: set when the role first deployed, with no console error recorded against it; TODO: re-verify against the running agent and drop the flag if nothing breaks
 whitelist:
   font-src: []
   connect-src: []

roles/web-app-homeassistant/meta/csp.yml

@@ -1,7 +1,7 @@
 ---
 flags:
   script-src-elem:
-    unsafe-inline: true
+    unsafe-inline: true # nocheck: csp-unsafe  Reason: the frontend index document boots the panel from an inline module script, so the dashboard stays blank without it; TODO: pin the payload by hash instead
 whitelist:
   font-src: []
   connect-src: []

roles/web-app-litellm/meta/csp.yml

@@ -1,7 +1,7 @@
 ---
 flags:
   script-src-elem:
-    unsafe-inline: true
+    unsafe-inline: true # nocheck: csp-unsafe  Reason: set when the role first deployed, with no console error recorded against it; TODO: re-verify against the running admin UI and drop the flag if the login gate renders without it
 whitelist:
   font-src: []
   connect-src: []