feat(forms): add isolated Form A iframe adapter

www/tools/phase10-artifact-verify.mjs

@@ -39,6 +39,7 @@ function hasTerminalSlash(url) {
 function unsafeSignals(html) {
   const signals = [];
   if (/<iframe\b[^>]*\bsrc=["'][^"']*jotform/i.test(html)) signals.push('active Jotform iframe');
+  if (/262946078314059/i.test(html)) signals.push('isolated-test Form A identifier');
   if (/<script\b[^>]*\bsrc=["'][^"']*(?:jotform|googletagmanager|google-analytics|doubleclick)/i.test(html)) signals.push('active vendor tracking/form script');
   if (/data-(?:form|forms)-mode=["']live["']/i.test(html)) signals.push('live form mode');
   if (/api\.azinstitute4autism\.com/i.test(html)) signals.push('production API origin');
@@ -98,14 +99,20 @@ export async function verifyArtifact(root, mode = 'staging') {
   if (secretSignals.length) errors.push(`unsafe artifact signals: ${JSON.stringify(secretSignals)}`);
 
   const files = (await fg('**/*', { cwd: root, absolute: true, onlyFiles: true })).sort();
+  const formAResourceFiles = [];
   const digest = createHash('sha256');
   for (const file of files) {
     const relative = path.relative(root, file).replaceAll(path.sep, '/');
+    if (/\.(?:html?|js|mjs|css|json|xml|txt)$/i.test(relative)) {
+      const contents = await fs.readFile(file, 'utf8');
+      if (/262946078314059/i.test(contents)) formAResourceFiles.push(relative);
+    }
     digest.update(relative);
     digest.update('\0');
     digest.update(createHash('sha256').update(await fs.readFile(file)).digest('hex'));
     digest.update('\n');
   }
+  if (formAResourceFiles.length) errors.push(`isolated-test Form A identifier appears in artifact: ${formAResourceFiles.join(', ')}`);
   return {
     mode,
     htmlRoutes: htmlFiles.length,