so github's new header killed every HACS download (Got more than 8190 bytes when reading: b"default-src 'none')

[Tribal Batman]

cards, integrations, the HAOS 18.3 update, even hacs trying to update itself. every one of them dies with

Download failed - 400, message='Got more than 8190 bytes when reading: b"default-src \'none\'; base-uri \'self\'; child-src github.githubassets.com github.com/assets-cdn/worker/...".'

github's release redirect started sending a 9kb CSP header and aiohttp gives up past 8190. nothing wrong on the HA box at all. looks fixed on github's end now, restart HA and reload hacs and downloads go through