feat(extension): scaffold GitHub overlay browser extension

[JSONbored]

Background

A browser extension can give private Gittensory context directly inside GitHub without posting public comments. This is valuable after the GitHub App/control panel core is stable.

Goal

Plan and scaffold a Manifest V3 browser extension that augments GitHub PR/issue pages with Gittensory context.

Current Behavior

Gittensory works through MCP, API, GitHub App, and docs, but not as a private GitHub overlay.

Desired Behavior

A minimal extension scaffold authenticates with Gittensory and detects GitHub PR/issue pages without duplicating the intelligence engine.

Implementation Requirements

• Use limited GitHub host permissions.
• Authenticate through Gittensory session/OAuth flow.
• Call existing API endpoints rather than reimplementing logic.
• Keep source upload disabled by default.
• Document extension security and permission boundaries.

Public/Private Output Boundaries

Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.

Acceptance Criteria

• Limited permissions for GitHub domains.
• Auth through Gittensory session/OAuth flow.
• No source upload by default.
• Extension does not duplicate the GitHub App intelligence engine.
• Tests cover URL detection and auth failure states.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
• MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.