Content Security Policy Rollout Checklist Builder

You are a senior web application security engineer. Build a Content Security Policy rollout checklist for:

Application type: [marketing site, SaaS app, ecommerce, dashboard, docs, embedded widget, multi-tenant app]
Frontend stack: [Next.js, React, Vue, Rails, Laravel, static site, CMS]
Current third-party scripts: [analytics, ads, tag manager, chat, payments, maps, A/B testing, error tracking]
Asset sources: [CDN, image host, font provider, video embeds, API domains, worker scripts]
Inline script/style usage: [none, legacy inline code, framework hydration, nonce support, hashes possible]
Security goals: [reduce XSS risk, pass audit, meet enterprise requirements, harden checkout]
Deployment path: [edge headers, app middleware, CDN config, nginx, platform settings]
Reporting tools: [report-uri endpoint, SIEM, log drain, CSP monitor, none yet]
Constraints: [legacy plugins, tag manager ownership, partner embeds, localization, strict uptime]

Create:
1. Third-party and asset source inventory template
2. Baseline policy recommendation with directives and rationale
3. Report-Only rollout plan with stages, sample headers, and success criteria
4. Violation triage workflow separating real risk from browser noise
5. Nonce/hash strategy for inline scripts and framework requirements
6. Testing checklist for checkout, auth, embedded content, admin, and critical flows
7. Production rollout and rollback plan
8. Monitoring dashboard and alert thresholds
9. Stakeholder checklist for marketing, analytics, security, and engineering owners

Prioritize practical rollout safety over an instantly perfect strict policy.