[YvesCesar]

What was wrong

The header and footer fragments synced from the static site replace the theme's template parts and load their CSS and JavaScript (as a module) on every front-end page. That included the checkout, the order received page, My Account with its login and registration forms, and the lost password page, so any script published on the static site ran next to passwords, billing data and tax IDs, and with the session of an administrator browsing the store.

What changed

On the checkout, the order received page, My Account (which also covers login, registration and the lost password endpoint) and the direct /lost-password/ route, the fragment CSS and JS are no longer enqueued and the header/footer template parts keep the theme's own markup. Other pages (shop, product, cart and so on) keep using the synced fragments as before.

On a site whose front page is My Account, the home page is covered by the same rule.

Verification

• New integration test covering the four kinds of page: the fragment markup is not rendered and its assets are not enqueued. It fails on main and passes with the change; the existing test for the other pages still passes.
• composer ci green locally on PHP 8.3: lint, PHPCS, PHPStan, 140 unit and 171 integration tests (also with --order-by=random).
• On a local install with synced fragments, /my-account/ and /lost-password/ no longer reference the fragment scripts, while the cart still does.