Use SAMEORIGIN globally instead of per-path X-Frame-Options override

Cloudflare Pages merges headers from all matching rules rather than
overriding, so the path-specific SAMEORIGIN conflicted with the global
DENY. Switch the global rule to SAMEORIGIN since the site only frames
its own antipattern example pages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/build.js

@@ -477,7 +477,7 @@ function generateCFConfig(buildDir) {
   // _headers: security + cache headers
   const headers = `/*
   X-Content-Type-Options: nosniff
-  X-Frame-Options: DENY
+  X-Frame-Options: SAMEORIGIN
 
 # HTML pages: browser always revalidates, CDN caches 1h
 /*.html
@@ -503,10 +503,6 @@ function generateCFConfig(buildDir) {
 /antipattern-images/*
   Cache-Control: public, max-age=604800, stale-while-revalidate=86400
 
-# Antipattern examples: allow same-origin framing (visual-mode page embeds these)
-/antipattern-examples/*
-  X-Frame-Options: SAMEORIGIN
-
 # Root static assets (favicon, og-image, etc.)
 /favicon.svg
   Cache-Control: public, max-age=604800, stale-while-revalidate=86400