Marshal injects data as a JSON script tag into the HTML payload before the </head> tag.
data is enforced as map[string]any to guarantee a stable key-based contract with the client SDK.
nonce is optional; if empty, the nonce attribute is omitted from the script tag.