hit this too on a self-hosted setup. worked around it at the reverse proxy for now - since hcaptcha.com is already in the CSP directives turnstile needs, i just append the turnstile origin next to it. caddy example:
that covers script/style/connect/frame in one go and the widget renders. obviously just a stopgap til the CSP knows about the turnstile provider, but figured it'd help anyone else stuck on the empty captcha box.
Thread
Comment by @b-hayes