Studio: fix two Codex findings on PR 5717 head

P1 -- ``scripts/check_new_install_scripts.py``: the head-only
rejection only refused new HEAD entries, not deletions. That left a
two-step bypass open:
  1. PR A removes ``studio/frontend/.install-script-allowlist`` on
     main (passes, since the lockfile has no new install-script
     deps).
  2. PR B then hits the bootstrap path (base allowlist missing)
     and self-allowlists any newly introduced install-script
     dependency, because bootstrap mode accepts head as-is.
Now also fail when head DROPS trusted base entries. Allowlist
deletions must land via their own reviewed commit instead of
chaining into the bootstrap window.

P2 -- ``html-svg-renderer.tsx``: ``<style>`` is removed from the
SVG sanitizer's FORBID_TAGS. The original justification was "inline
CSS would leak to the host page selectors", but the SVG preview
runs inside ``sandbox=""`` plus ``default-src 'none'`` -- the inner
``<style>`` cannot reach host page selectors and cannot fetch
external URLs (the CSP blocks ``@import`` and ``url(...)``).
Stripping ``<style>`` was breaking legitimate class-styled SVG
exports from real diagram tools. The existing
"strips inline <style>" test is replaced with one that proves
class-styled SVG renders as authored.

scripts/check_new_install_scripts.py

@@ -372,6 +372,31 @@ def main(argv: list[str] | None = None) -> int:
                 )
             return 1
 
+        # Also refuse a PR that DROPS trusted base entries. Without
+        # this, an attacker could land a two-step bypass:
+        #   1. PR A removes ``.install-script-allowlist`` from base
+        #      (passes -- no new lockfile findings).
+        #   2. PR B then hits the bootstrap path (base allowlist
+        #      missing) and self-allowlists a newly introduced
+        #      install-script dependency.
+        # Removing an allowlist entry is a security-sensitive change
+        # and must land via the same review path that added it.
+        removed_from_head = sorted(base_allowlist - head_allowlist)
+        if removed_from_head:
+            print(
+                "[install-script-diff] FAIL: PR removes trusted base "
+                "allowlist entries. Allowlist deletions must land in a "
+                "separate, isolated commit so a follow-up PR cannot "
+                "exploit the bootstrap path.",
+                file = sys.stderr,
+            )
+            for entry in removed_from_head:
+                print(
+                    f"  dropped allowlist entry: {entry}",
+                    file = sys.stderr,
+                )
+            return 1
+
         # Only the trusted base allowlist participates in the skip set.
         allowlist = base_allowlist