feat(extension): support multi-extension GitHub release repos

[jkirsteins]

Summary

Add support for installing and listing multiple pup-* extensions from a single GitHub release repository.

This lets a release archive contain executables such as pup-foo and pup-bar, then allows users to install one extension, install all discovered extensions, or list remote versions before installing.

Changes

• Add pup extension list-remote owner/repo
• Add pup extension install owner/repo --extension <name>
• Add pup extension install owner/repo --all
• Support exact release tags with --tag
• Infer extension names from platform release archives
• Preserve archive source metadata in installed extension manifests
• Support upgrades for archive-sourced extensions
• Add bounded archive scanning and download limits
• Verify checksums when checksums.txt is present
• Use staged extension writes with rollback for local, single-binary GitHub, and archive GitHub installs
• Avoid invoking gh on the hot path for public GitHub requests; use it only after private/inaccessible repo failures

Trying It

Build locally:

cargo build

List remote extensions from a repository:

target/debug/pup -o table extension list-remote owner/repo

List versions for one extension:

target/debug/pup -o table extension list-remote owner/repo --extension foo

Install the latest stable release containing one extension:

target/debug/pup extension install owner/repo --extension foo

Install a specific release tag:

target/debug/pup extension install owner/repo --extension foo --tag v1.2.3

Install every discovered extension from the selected archive:

target/debug/pup extension install owner/repo --all

Force reinstall or upgrade an existing extension:

target/debug/pup extension install owner/repo --extension foo --force
target/debug/pup extension upgrade foo

For private repositories, either provide a token:

GH_TOKEN=<token> target/debug/pup extension list-remote owner/repo

or authenticate with GitHub CLI:

gh auth login --hostname github.com --scopes repo
target/debug/pup extension list-remote owner/repo

Testing

• cargo fmt --check
• cargo clippy -- -D warnings
• cargo test -- --test-threads=1

Notes

Remote listing currently infers extension names by inspecting bounded platform release archives. A future improvement could add a small release manifest/index asset to avoid downloading archives for metadata-only listing.

[platinummonkey]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ea0b8ec811

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".