feat(extension): add public-safe packet copy and private blocker actions in GitHub overlay

[jonathanchang31]

Summary

This change implements issue #147 by extending the browser extension and API to support:

• Copyable public-safe PR packet content from the GitHub overlay
• Authenticated private blocker details in the same overlay

The implementation reuses existing public-safety sanitization behavior and keeps extension output within public/private boundaries.

Related issue

Closes: #147

Change Type

• Feature
• Security hardening (public/private output boundary enforcement)
• API enhancement
• Extension UI enhancement
• Tests added/updated
• Breaking change

Real Behavior Proof

1) Extension context now includes action payloads

GET /v1/extension/pull-context?... returns:

• actions[] containing:
  • id: "copy_public_safe_packet"
  • id: "view_private_blockers"

2) Public-safe packet output is sanitized

Integration checks confirm packet content excludes sensitive terms such as:

• wallet / hotkey / coldkey
• reward estimate / payout / farming
• raw trust score / estimated score / score estimate
• private reviewability

3) Private blockers remain auth-scoped

Extension context remains accessible only through extension-scoped session flow; private blocker details are surfaced only in that authenticated context.

4) Extension UI behavior

Overlay now renders:

• “Copy public-safe packet” button (clipboard copy)
• “Private blockers” expandable panel

Checklist

• Implemented API support for extension packet/blocker actions
• Implemented extension UI actions
• Enforced public-safe text boundaries
• Kept private blocker data behind authenticated extension session
• Added/updated automated tests
• Verified local typecheck and tests pass

[JSONbored]

@jonathanchang31 failing CI, please resolve.

[superagent-security]

Superagent found 1 security concern(s).

[jonathanchang31]

@JSONbored Could you plz review my PR again? Thanks! && I Love Gittensory!

@jonathanchang31 current head looks ready from this pass.

A few notes:

• The extension-scoped route boundary is preserved: private pull context stays behind the extension session path.
• The public-safe packet path fails closed instead of trying to partially redact unsafe content.
• I checked the current fetched head and did not find the conflict markers called out by the active scanner thread, so that thread looks stale.
• No code changes requested.

Validation expected:

• Current GitHub checks are green.
• Maintainer should resolve the stale review/thread state before landing this.