extract: document v2.1.220

[lroolle]

Deterministic extraction for v2.1.220, compared against v2.1.197.

All scripts/validate-extraction.sh gates passed — this is the artifact set
produced by run 30523354620.
The binary and unpacked package were not committed (manifest + hashes only).

Why this is opened by hand

deterministic-extract had failed every weekly run since 2026-06-15, so
this PR closes a 7-week documentation gap (v2.1.197 → v2.1.220). Two separate
blockers were stacked:

1. npm pack stdout leak — fixed in 3829517. npm ≥ 10 prints the packed
   tarball name on stdout even under --silent; pack() never consumed that
   line, so it merged with the function's own ls output and callers got a
   two-line string where a path belonged.

2. GitHub Actions is not permitted to create or approve pull requests —
   still open. can_approve_pull_request_reviews is false at both org and
   repo level, so peter-evans/create-pull-request cannot open the PR with
   the built-in GITHUB_TOKEN.

Blocker 2 is left for a human decision on purpose: this workflow's header
declares "Adds NO secrets. Uses the built-in GITHUB_TOKEN with least
privilege." Every fix trades against that invariant, so it should not be
picked silently.

Highlights in this diff

• paths: 83 total, 15 added, 1 removed — new /api/frame/* surface,
  /v1/design/*, org-scoped MCP connector and skills search endpoints
• beta_flags: 49 total, 5 added, 1 removed