PostCSS map option traversal

Trap: setting PostCSS map explicitly to control source maps looks harmless because source-map generation is often treated as opt-in. Fix: never set map in the PostCSS processing path; it is opt-out there, and loading a prior map can implicitly generate result.map while attacker-controlled annotations can traverse paths through loadMap().