Rework extension management for pinned profiles

AGENTS.md

@@ -160,6 +160,8 @@ Some Codex patches modify files that earlier patches also touch. When this happe
 |-------|-----------|
 | `feat-cli-pinning.patch` | `binary-name.patch` (both modify `nativeHostMainService.ts`) |
 | `feat-codex-sideloader.patch` | `feat-codex-conductor.patch` (both add imports to `workbench.common.main.ts`) |
+| `fix-conductor-extension-read.patch` | `disable-signature-verification.patch` (both modify `extensionManagementService.ts`; the prerequisite shifts the file by -1 line, so the conductor patch must be generated against the post-prerequisite tree) |
+| `fix-extension-scope-inheritance.patch` | `disable-signature-verification.patch`, `fix-conductor-extension-read.patch` (all three modify `extensionManagementService.ts`; regenerate with both prerequisites listed first) |
 
 If a patch fails to apply with "patch does not apply", check whether a prerequisite patch changed the same file. Regenerate using `dev/patch.sh` with the prerequisite listed first.
 

patches/fix-conductor-extension-read.patch

@@ -0,0 +1,13 @@
+diff --git a/src/vs/platform/extensionManagement/node/extensionManagementService.ts b/src/vs/platform/extensionManagement/node/extensionManagementService.ts
+index cdf0c67..73897eb 100644
+--- a/src/vs/platform/extensionManagement/node/extensionManagementService.ts
++++ b/src/vs/platform/extensionManagement/node/extensionManagementService.ts
+@@ -864,7 +863,7 @@ export class ExtensionsScanner extends Disposable {
+ 	async scanLocalExtension(location: URI, type: ExtensionType, profileLocation?: URI): Promise<ILocalExtension> {
+ 		try {
+ 			if (profileLocation) {
+-				const scannedExtensions = await this.extensionsScannerService.scanUserExtensions({ profileLocation });
++				const scannedExtensions = await this.extensionsScannerService.scanUserExtensions({ profileLocation, includeInvalid: true });
+ 				const scannedExtension = scannedExtensions.find(e => this.uriIdentityService.extUri.isEqual(e.location, location));
+ 				if (scannedExtension) {
+ 					return await this.toLocalExtension(scannedExtension);

patches/fix-extension-scope-inheritance.patch

@@ -0,0 +1,9 @@
+diff --git a/src/vs/platform/extensionManagement/node/extensionManagementService.ts b/src/vs/platform/extensionManagement/node/extensionManagementService.ts
+index 84bbc73..322a6bb 100644
+--- a/src/vs/platform/extensionManagement/node/extensionManagementService.ts
++++ b/src/vs/platform/extensionManagement/node/extensionManagementService.ts
+@@ -1046,3 +1046,3 @@ class InstallExtensionInProfileTask extends AbstractExtensionTask<ILocalExtensio
+ 		const metadata: Metadata = {
+-			isApplicationScoped: this.options.isApplicationScoped || existingExtension?.isApplicationScoped,
++			isApplicationScoped: this.options.isApplicationScoped ?? existingExtension?.isApplicationScoped,
+ 			isMachineScoped: this.options.isMachineScoped || existingExtension?.isMachineScoped,