feat(extensions): define package signature contract

[luoye520ww]

Problem

The extension platform has package SHA-256 checks, but no bounded contract for publisher-signed package metadata. Without a shared contract, later install and trust code can disagree on algorithms, key sizes, validity windows, or canonical signed bytes.

Scope

This PR defines and validates the shared package-signature metadata contract only. It does not verify signatures cryptographically, persist publisher trust, or change installation behavior.

Changes

• Add a strict Ed25519 signature metadata parser with bounded publisher/key identifiers.
• Validate exact Ed25519 public-key/signature Base64 sizes, lowercase SHA-256 package digest, and strict UTC validity timestamps.
• Add deterministic canonical payload construction for future signature verification.
• Add fail-closed validity-window checks with deterministic tests.

Safety

• Untrusted input is parsed without executing code or loading keys.
• Secrets are not accepted as fields and no data is persisted.
• Invalid algorithms, malformed digests, control characters, ambiguous timestamps, invalid Base64 padding, and reversed windows are rejected.

Validation

• npm.cmd exec vitest run src/shared/extension-signature.test.ts (7 passed)
• npm.cmd --prefix kun run typecheck (passed)
• npm.cmd run typecheck (passed)
• npm.cmd run lint (passed)
• npm.cmd run build (passed)
• git diff --check (passed)

Review performed

Reviewed functional correctness, untrusted-input handling, validity/lifecycle boundaries, cross-layer compatibility, security, test quality, and PR scope. Review findings were fixed before the final gate, including strict timestamp validation, control-character handling, and exact Base64 padding.

Follow-ups

Cryptographic verification, publisher trust/revocation storage, CLI validation, and install UI enforcement remain separate PRs.

[luoye520ww]

Closing this split PR to reduce review fragmentation. The branch and commits are preserved; this work will be reintroduced in a smaller consolidated PR after the current reliability baseline is merged.

[luoye520ww]

Closed as part of PR consolidation; no branch data was deleted.

[luoye520ww]

Reopened for targeted CI repair and verification; this PR remains in the active fix set.

[XingYu-Zhong]

Thank you for starting the extension-signature contract. I am closing this conflicting branch in favor of #979.

The replacement was rebuilt on current develop and narrows this to a reviewable contract: every identity, package, algorithm/version, and validity field is bound into fixed canonical bytes; unknown/self-asserted key fields and non-canonical values are rejected; SemVer input is bounded; and expiry follows the repository's existing half-open semantics. Trust lookup and cryptographic verification remain explicitly out of scope instead of being implied by the envelope.

Your original contract direction is credited in the replacement PR.