feat(extension): derive the version as unpadded CalVer (milestone 318 step 8)

`1.0.<minutes since 2020>` -> `YYYY.M.D.HHMM` UTC, from the commit time of
the newest change to a packaged extension file. Same clock and same commit as
before; readable instead of opaque, and the same value the rest of the family
derives.

The hold on this step was two questions about AMO, and Mozilla's own docs
answer both:

    ^(0|[1-9][0-9]{0,8})([.](0|[1-9][0-9]{0,8})){0,3}$

  1. four all-numeric segments -> ACCEPTED ({0,3} more after the first).
  2. leading zeros              -> REJECTED. A segment is the single digit
     `0` or starts 1-9, so `08` and `0201` are refused. MDN says it in prose
     too: "Non-zero numbers must not include a leading zero."

So the documented fallback applies, extension only: the same numbers rendered
without the family's zero-padding. `2026.08.29.0201` and `2026.8.29.201` are
one value in two renderings — rule 148 defines comparison as numeric per
segment, under which they are equal — so nothing already published is
reordered, and left-padding each segment recovers the family string exactly.
HHMM stays one segment because AMO allows at most four.

The transition is safe in the other direction too: 2026 > 1, so every CalVer
outranks every published 1.0.x. build.yml's downgrade guard confirms it.

Also in scope:

* MAJOR.MINOR is gone. `cmd_major_minor`, `cmd_patch` and VERSION_EPOCH go
  with it, the committed version in manifest.json / package.json is now
  wholly inert, and ci.yml's MAJOR.MINOR-agreement check is retired rather
  than left running beside a fact that stopped existing (rule 22).
* ci.yml's `extension-version` lane now asserts Mozilla's regex verbatim
  instead of a loose `^[0-9]+(\.[0-9]+)*$` — which would have passed the
  padded shape. It also asserts YYYY.M.D.HHMM, because AMO would accept a
  regression to `1.0.<minutes>` while that orders below everything signed
  since. Checking here is the point: AMO 409s on re-signing, so a version it
  rejects is burned and cannot be reused.
* `artifacts.sh version extension` delegates to packaging.sh, so the two
  cannot answer differently. The direction matches the existing one —
  artifacts.sh already asks packaging.sh for the extension's path set.

#3156 is what makes this commit safe to make: packaging.sh is in web's path
set, so the web revision moves with the extension version and build-web
rebuilds instead of republishing an image bundling the previous XPI.

Scribe #3138.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -75,18 +75,23 @@ jobs:
           fetch-depth: 0
 
       # The version is DERIVED, not read from the repo (milestone 271 step 4,
-      # cut over 2026-08-27). `packaging.sh version` returns MAJOR.MINOR from
-      # manifest.json plus a patch component that is the commit TIME of the
-      # newest change to a PACKAGED extension file, in minutes since
-      # 2020-01-01 — family rule 149, never a commit count, which orders by
+      # cut over 2026-08-27). `packaging.sh version` returns `YYYY.M.D.HHMM`
+      # UTC — the commit TIME of the newest change to a PACKAGED extension
+      # file, per family rule 148/149. Never a commit count, which orders by
       # branch rather than by recency.
       #
-      # The committed "version" in manifest.json / package.json no longer
-      # decides anything: the stamp step below overwrites it in the working
-      # tree before web-ext ever reads it. It is deliberately NOT committed
-      # back — the commit carrying the bump would itself be a change to the
-      # extension and would move the version again. The repo holds the source;
-      # the build derives the label.
+      # Unpadded, and only here: AMO's grammar rejects a leading zero, so the
+      # extension renders rule 148's numbers without the family's padding
+      # (milestone 318 step 8). Same value, one character narrower per segment;
+      # ci.yml's extension-version lane checks the string against Mozilla's
+      # published regex before this job ever calls AMO.
+      #
+      # The committed "version" in manifest.json / package.json decides NOTHING
+      # — not even a MAJOR.MINOR prefix, which step 8 removed. The stamp step
+      # below overwrites it in the working tree before web-ext ever reads it,
+      # and it is deliberately NOT committed back: the commit carrying the bump
+      # would itself be a change to the extension and would move the version
+      # again. The repo holds the source; the build derives the label.
       - name: Derive extension version
         id: extver
         run: |

.forgejo/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 # CI lanes per FabledRulebook/forgejo.md "CI philosophy":
 #   - lint: ruff only, no dep install — fast-fail for the common lint bounce.
-#   - extension-version: the derived version resolves and MAJOR.MINOR agrees.
+#   - extension-version: the derived version resolves and is a shape AMO takes.
 #   - backend-lint-and-test: `pytest -m "not integration"`, no service containers.
 #   - frontend-build: vitest unit + vite build.
 #   - integration: pgvector + redis service containers; alembic + `pytest -m integration`.
@@ -58,9 +58,12 @@ jobs:
   # the extension.yml suite runs on node:24-slim, which is exactly why
   # version.spec.js sticks to packaging.sh's git-free subcommands.
   #   1. the derivation actually resolves on this commit
-  #   2. MAJOR.MINOR agrees between the two files — the one part still hand-set,
-  #      and packaging.sh reads it from manifest.json ALONE, so a divergence
-  #      ships a version package.json disagrees with
+  #   2. the derived string is one AMO will accept, checked against Mozilla's
+  #      own published grammar rather than a loose "digits and dots"
+  #
+  # The MAJOR.MINOR-agreement check that used to be (2) is gone with milestone
+  # 318 step 8: the committed version no longer seeds anything, so there is no
+  # hand-set part left for the two files to disagree about.
   #
   # Deliberately NOT checked here: that the derived value beats what has already
   # been signed. That guard belongs in build.yml, where it compares against the
@@ -85,27 +88,38 @@ jobs:
           # busybox sh on the act_runner — no bashisms (family rule).
           VERSION=$(sh extension/scripts/packaging.sh version)
           echo "derived: $VERSION"
-          # The shape AMO accepts, and the shape build.yml will stamp.
-          if ! echo "$VERSION" | grep -qE '^[0-9]+(\.[0-9]+)*$'; then
-            echo "ERROR: derived version '$VERSION' is not plain dotted-numeric."
-            echo "AMO would reject it, and build.yml stamps it verbatim."
+
+          # Mozilla's published grammar for AMO, transcribed verbatim from
+          # MDN's manifest.json/version page:
+          #
+          #     ^(0|[1-9][0-9]{0,8})([.](0|[1-9][0-9]{0,8})){0,3}$
+          #
+          # Not the looser `^[0-9]+(\.[0-9]+)*$` this lane used to carry. That
+          # one passes `2026.08.29.0201`, which AMO REJECTS — a segment must be
+          # the single digit 0 or start 1-9 — and it also passes five segments,
+          # where AMO allows four. Both would surface as a failed sign with the
+          # version already burned: AMO 409s on re-signing, so a rejected value
+          # cannot be reclaimed and cannot be reused. This lane is the cheap
+          # place to find out. (#3138, milestone 318 step 8.)
+          if ! echo "$VERSION" | grep -qE '^(0|[1-9][0-9]{0,8})(\.(0|[1-9][0-9]{0,8})){0,3}$'; then
+            echo "ERROR: derived version '$VERSION' is not a version AMO accepts."
+            echo "AMO's grammar: ^(0|[1-9][0-9]{0,8})([.](0|[1-9][0-9]{0,8})){0,3}$"
+            echo "Most likely cause: a zero-padded segment (08, 0201). The rest"
+            echo "of the family pads; the extension must not — see packaging.sh."
             exit 1
           fi
-          mm() { grep -E '"version"' "$1" | head -1 | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([0-9]+\.[0-9]+).*/\1/'; }
-          MAN=$(mm extension/manifest.json)
-          PKG=$(mm extension/package.json)
-          test -n "$MAN" || { echo "ERROR: no parseable version in extension/manifest.json"; exit 1; }
-          test -n "$PKG" || { echo "ERROR: no parseable version in extension/package.json"; exit 1; }
-          if [ "$MAN" != "$PKG" ]; then
-            echo "ERROR: MAJOR.MINOR disagrees between the two files."
-            echo "  extension/manifest.json = $MAN  <- packaging.sh reads MAJOR.MINOR from here"
-            echo "  extension/package.json  = $PKG"
-            echo "Only MAJOR.MINOR is hand-set. The patch component is derived from"
-            echo "commit time and overwritten at build time, so the committed patch"
-            echo "numbers are inert — but MAJOR.MINOR still ships. Set both the same."
+
+          # ...and the shape this project actually derives. AMO would happily
+          # take `1.0.3500147` too, so the grammar check alone would not notice
+          # a regression to the pre-318 shape — which orders BELOW everything
+          # signed since, and is unrecoverable once Firefox has the higher one.
+          if ! echo "$VERSION" | grep -qE '^20[0-9][0-9]\.[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,4}$'; then
+            echo "ERROR: derived version '$VERSION' is not YYYY.M.D.HHMM."
+            echo "Rule 148's CalVer is what build.yml signs; the old"
+            echo "1.0.<minutes> shape would order below every ext-2026.* release."
             exit 1
           fi
-          echo "OK: MAJOR.MINOR $MAN, derived version $VERSION"
+          echo "OK: derived version $VERSION"
 
   backend-lint-and-test:
     runs-on: python-ci