feat(extensions): bind package signature payload

[XingYu-Zhong]

Summary

• Rebuilds the extension-signature contract from feat(extensions): define package signature contract #938 on the current develop branch.
• Defines the canonical bytes a future trust-store/verification layer must verify; this PR intentionally does not claim to implement trust or cryptographic verification.

Changes

• Binds payload version, algorithm, publisher/key identity, extension identity/version, package SHA-256, and validity timestamps.
• Rejects unknown/missing fields, self-asserted public keys, non-canonical Base64, timestamps, hashes, publisher mismatches, and oversized/non-SemVer versions.
• Emits a deterministic versioned JSON payload with fixed field order.
• Provides deterministic validity-window checks.

Tests

• npx vitest run src/shared/extension-signature.test.ts (13 passed).
• Full root app suite (4496 passed) plus all extension-package suites (58 passed).
• Root typecheck, targeted ESLint, and git diff --check.

Original contribution and contract direction: @luoye520ww in #938.

Replaces #938.