refactor(extension): one definition of what ships in the XPI

Milestone #271 step 1. Groundwork for deriving the extension version from git;
no behavior change yet -- nothing consumes `version` so far.

"Which files end up in the XPI" was stated in two places and about to become
three. Three hand-kept copies of one fact is what allowed #2397, where the
publish path could republish a stale XPI because its cache key had no link to
the content it stood for.

New extension/scripts/packaging.sh holds the single declaration and exposes:
  ignore       web-ext --ignore-files values
  pathspec     :(exclude)extension/... for git
  version      <MAJOR.MINOR from manifest>.<commit count over packaged files>
  major-minor  /  patch

Consumers now delegate instead of restating it:
- extension/package.json -- all four web-ext scripts
- .forgejo/workflows/ci.yml -- the extension-version guard's exclusions
- (step 4) the rev-list that derives the version

scripts/** joins the non-packaged set; the script must not ship to users.

Two shell hazards, both load-bearing:

The script runs `set -euf`. Its lists are iterated with deliberate word
splitting, and without -f the shell ALSO globs them -- invoking `pathspec`
from a directory where test/ exists (exactly how ci.yml calls it) would expand
`test/**` into the individual spec files and silently stop covering anything
added later. A caller's own `set -f` cannot prevent this: the script is a
separate sh process and does not inherit it.

Callers additionally need their own `set -f` for the substituted RESULT, which
is a different expansion. version.spec.js asserts every --ignore-files caller
sets it, that the pathspec comes through with `test/**` literal and no
.spec.js paths, and that neither consumer has reinstated a hardcoded list --
the easy future regression is "simplifying" by inlining one again.

Verified: all five subcommands plus the usage/exit-2 path. Derived version on
main (8300029) is 1.0.19, matching dev. Last published is 1.0.10, so the
eventual cutover moves strictly upward and needs no offset -- Firefox refuses
downgrades. (An earlier note recorded 18; that was measured against a stale
origin/main from before the PR #234 merge.)

Refs #2398

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -121,20 +121,16 @@ jobs:
             echo "OK: extension version $PKG"
             exit 0
           fi
-          # Exclusions mirror --ignore-files in extension/package.json's web-ext
-          # scripts: these files are not packaged into the XPI, so touching them
-          # (e.g. Renovate bumping the web-ext devDep, or editing a spec)
-          # changes nothing shipped and must not demand a version bump.
-          # KEEP IN SYNC with --ignore-files — a file packaged into the XPI but
-          # excluded here is exactly the silent-stale-ship this job exists to
-          # prevent. test/version.spec.js pins the two lists' shared intent.
-          CHANGED=$(git diff --name-only "$BASE" HEAD -- extension/ \
-            ':(exclude)extension/package.json' \
-            ':(exclude)extension/package-lock.json' \
-            ':(exclude)extension/README.md' \
-            ':(exclude)extension/.gitignore' \
-            ':(exclude)extension/vitest.config.js' \
-            ':(exclude)extension/test/**')
+          # The exclusion list is NOT written out here — it comes from
+          # extension/scripts/packaging.sh, the one definition of what ships,
+          # shared with web-ext's --ignore-files and the derived-version patch
+          # count. Three hand-kept copies of that fact is how #2397 happened.
+          #
+          # `set -f` is required around the substitution: without it the shell
+          # globs `test/**` against the working tree and silently narrows it.
+          set -f
+          CHANGED=$(git diff --name-only "$BASE" HEAD -- extension/ $(sh extension/scripts/packaging.sh pathspec))
+          set +f
           if [ -z "$CHANGED" ]; then
             echo "No packaged extension files changed since $BASE — nothing to guard."
             echo "OK: extension version $PKG"