feat(extension): build and ship a Firefox add-on (#188)

Derive a Gecko-compatible manifest at build time and package
extension-firefox.zip alongside the Chrome zip:

- background service worker is declared as an event-page `scripts`
  entry (top-level listeners + in-memory Map run unchanged on Gecko)
- browser_specific_settings.gecko with id, strict_min_version 140.0,
  and data_collection_permissions (required by AMO; honored on 140+)
- packZip helper parameterized over cwd/excludes; `*.DS_Store` strips
  junk at every depth and .DS_Store is excluded from the staging copy
- guard against a missing background.service_worker shape

CI now builds the extension and runs a pinned `web-ext@8 lint` over
the staged Firefox tree (innerHTML warnings are non-blocking); the
unpacked staging dir is excluded from the uploaded artifact. The
release script attaches both zips and points to AMO.

Bumps the extension to v1.2.0 with a changelog entry.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Paul Bakaus <paul.bakaus@gmail.com>

.github/workflows/ci.yml

@@ -84,21 +84,31 @@ jobs:
         if: needs.changes.outputs.detector == 'true'
         run: bun run build:browser
 
-      - name: Rebuild extension detector
-        if: needs.changes.outputs.detector == 'true'
-        run: bun run build:extension
-
       - name: Build
         run: bun run build
 
+      - name: Build extension
+        if: needs.changes.outputs.detector == 'true'
+        run: bun run build:extension
+
+      - name: Lint Firefox extension (web-ext)
+        if: needs.changes.outputs.detector == 'true'
+        # Pinned for reproducible CI. Fails on AMO errors; innerHTML style
+        # warnings in the panel renderer are non-blocking and not promoted to
+        # errors here.
+        run: npx --yes web-ext@8 lint --source-dir dist/extension-firefox
+
       - name: Verify generated tracked outputs
-        run: git diff --exit-code -- .agents .claude .cursor .gemini .github/skills plugin cli/engine/detect-antipatterns-browser.js
+        run: git diff --exit-code -- .agents .claude .cursor .gemini .github/skills plugin cli/engine/detect-antipatterns-browser.js extension/detector
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@v7
         with:
           name: impeccable-dist
-          path: dist/
+          # Ship the packaged zips, not the unpacked Firefox staging tree.
+          path: |
+            dist/
+            !dist/extension-firefox/
           retention-days: 7
 
   cli-remote-e2e: