feat(connect): pivot extension install to Chrome Web Store path

Verified on Chrome 149 (unmanaged macOS): a force-install policy pointing at a
SELF-HOSTED crx is tagged [BLOCKED] in chrome://policy ("Error, Warning") — Chrome
refuses off-Web-Store force-installs on non-cloud-managed browsers. So the
self-hosted-crx approach cannot work on consumer Chrome; the extension must ship
via the Chrome Web Store (same reason codex/claude do).

- UPDATE_URL -> Chrome Web Store update endpoint; add STORE_URL (one-click Add to
  Chrome) as the guaranteed path + headless fallback
- install instructions now offer: A) one-click store link, B) silent profile
  force-install (works once published), with Load-unpacked as the pre-publish stopgap
- build extensions/ab-connect.zip (CWS upload package; manifest "key" kept so the
  published id stays ciiljdlhdpfckdcfkphgmfalanpdejep)
- extensions/store/{SUBMISSION.html,privacy.html}: full listing copy, permission
  justifications (debugger is the review-sensitive one), privacy policy
- drop dead self-hosted extensions/updates.xml; pack-extension.sh now builds the zip

Not released yet — force-install only works after the store listing is Published.

scripts/pack-extension.sh

@@ -1,34 +1,39 @@
 #!/bin/sh
-# Re-pack and sign extensions/ab-connect into extensions/ab-connect.crx using the
-# stable signing key, then print the extension id. Keeps the crx id (and thus the
-# native-messaging allowed_origins + force-install policy) constant across versions.
+# Build the Chrome Web Store upload package extensions/ab-connect.zip (and a signed
+# extensions/ab-connect.crx for reference) from extensions/ab-connect, keeping the
+# extension id constant via the stable signing key + manifest "key".
 #
-# The private key lives at .secrets/ab-connect.pem and is git-ignored. To re-pack
-# on another machine / in CI, restore it from a secret first (see RELEASING).
+# The id MUST stay ciiljdlhdpfckdcfkphgmfalanpdejep so the native-messaging
+# allowed_origins and the force-install policy keep matching. The id is pinned by
+# the "key" field in manifest.json (kept in the uploaded zip on purpose).
+#
+# The private key lives at .secrets/ab-connect.pem and is git-ignored.
 #
 # After changing the extension:
 #   1. bump "version" in extensions/ab-connect/manifest.json
-#   2. bump <updatecheck version=...> in extensions/updates.xml to match
-#   3. run this script
-#   4. commit extensions/ab-connect.crx + updates.xml + manifest.json
+#   2. run this script
+#   3. commit extensions/ab-connect.zip (+ .crx) + manifest.json
+#   4. upload ab-connect.zip to the Web Store (see extensions/store/SUBMISSION.html)
 set -e
 cd "$(dirname "$0")/.."
 KEY=.secrets/ab-connect.pem
 EXT=extensions/ab-connect
 CHROME="${CHROME_BIN:-/Applications/Google Chrome.app/Contents/MacOS/Google Chrome}"
 
-if [ ! -f "$KEY" ]; then
-  echo "error: $KEY missing. Restore the signing key (CI secret AB_CONNECT_PEM) before packing." >&2
-  exit 1
+# Web Store upload package (zip of the unpacked extension, dotfiles excluded).
+rm -f extensions/ab-connect.zip
+( cd "$EXT" && zip -rq ../ab-connect.zip . -x '.*' )
+[ -f extensions/ab-connect.zip ] || { echo "error: zip failed" >&2; exit 1; }
+
+# Signed crx (reference / non-store force-install for managed setups).
+if [ -f "$KEY" ]; then
+  rm -f extensions/ab-connect.crx
+  "$CHROME" --pack-extension="$PWD/$EXT" --pack-extension-key="$PWD/$KEY" >/dev/null 2>&1 || true
+  ID=$(openssl rsa -in "$KEY" -pubout -outform DER 2>/dev/null \
+       | openssl dgst -sha256 -binary | xxd -p -c256 | head -c32 | tr '0-9a-f' 'a-p')
+  echo "extension id: $ID"
+else
+  echo "note: $KEY missing — built zip only (no crx)."
 fi
-
-rm -f extensions/ab-connect.crx
-"$CHROME" --pack-extension="$PWD/$EXT" --pack-extension-key="$PWD/$KEY" >/dev/null 2>&1 || true
-[ -f extensions/ab-connect.crx ] || { echo "error: pack failed" >&2; exit 1; }
-
-ID=$(openssl rsa -in "$KEY" -pubout -outform DER 2>/dev/null \
-     | openssl dgst -sha256 -binary | xxd -p -c256 | head -c32 | tr '0-9a-f' 'a-p')
-echo "packed extensions/ab-connect.crx"
-echo "extension id: $ID"
+echo "packed extensions/ab-connect.zip"
 echo "manifest version: $(grep -o '"version"[^,]*' "$EXT/manifest.json" | head -1)"
-echo "updates.xml  version: $(grep -o "version='[^']*'" extensions/updates.xml | tail -1)"