feat(build): bundle Bear Spaces + Bear Containers into overlay — ship by default

[mdheller]

Summary

The two BearBrowser extensions (Bear Spaces, Bear Containers) were written but not bundled — users had to manually load them via about:debugging. This PR wires them into the overlay build so they're force-installed on first launch.

How it works

Step 1 — Pack (bearbrowser-pack-extensions.sh):

• Reads browser_specific_settings.gecko.id from each extensions/*/manifest.json
• Zips contents → build/extensions/<gecko-id>.xpi

Step 2 — Install (bearbrowser-install-extensions.sh):

• Copies .xpi files into BearBrowser.app/Contents/Resources/distribution/extensions/
• Merges policies.json (preserving existing policies):

  {
    "policies": {
      "Extensions": {
        "Install": ["file:///...bear-spaces@bearbrowser.local.xpi", "..."]
      },
      "ExtensionSettings": {
        "bear-spaces@bearbrowser.local": { "installation_mode": "force_installed" },
        "bear-containers@bearbrowser.local": { "installation_mode": "force_installed" }
      }
    }
  }

Overlay build (bearbrowser-overlay-binary.sh):

• New step 7 of 10: pack → install, after branding patches but before xattr-strip and ad-hoc signing
• Extensions are covered by the final signature

Files

File	Role
scripts/bearbrowser-pack-extensions.sh	Zip each extension → .xpi
scripts/bearbrowser-install-extensions.sh	Copy .xpi + write policies.json
scripts/bearbrowser-overlay-binary.sh	+step 7, renumbered 7→8→9→10
extensions/README.md	Developer docs: what each extension does, how to load for dev, build pipeline

Test plan

• ./scripts/bearbrowser-pack-extensions.sh — produces build/extensions/bear-spaces@bearbrowser.local.xpi and bear-containers@mdheller.xpi
• ./scripts/bearbrowser-install-extensions.sh /Applications/BearBrowser.app — XPIs copied, policies.json contains both force_installed entries
• Full overlay build (./scripts/bearbrowser-overlay-binary.sh) completes step 7 without error
• Launch BearBrowser — both extensions installed, no manual load required
• Existing policies.json entries (if any) not overwritten