TIL that CSS attr() cannot be used to compute anything in `url()` as the spec considers these to be “attr()-tainted” (for very valid security reasons): https://drafts.csswg.org/css-values-5/#attr-security

Thought maybe there was a way forward for global custom CSS-only favicons via new advancements in attr() https://developer.chrome.com/blog/advanced-attr (but alas, no — which, in hindsight — seems valid and fair)