TEST: full replica, /test/* — no CSP, no nosniff

Same USDZ + environmentmap as /classic, served without security headers.