ext: no-download-logic ESLint gate in the extension-lint CI job

CLAUDE.md §3's rule was prose only for extension/ (GUI already has
gui_no_download_logic as a ctest). eslint.config.mjs adds a
no-restricted-syntax/no-restricted-globals rule banning fetch/XHR/Request,
ReadableStream.getReader, Range/Content-Range header construction, and
IndexedDB in src/**/*.ts. Verified red on a planted violation (fetch +
Range header + stream reader) and green on ordinary code; that check is
now a permanent regression test (tests/lint/no-download-logic.test.ts)
rather than a one-off manual run. Wired into the existing extension-lint
job in .github/workflows/ci.yml, ahead of web-ext lint.

Generated protocol code (src/shared/protocol/**) is excluded from lint
entirely — it must never be hand-edited, so flagging it as fixable would
be a lie.

Answers gui/docs/ext-requests-m1.md.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Ed8KEmAW48v4YHdxLtqsMB

.github/workflows/ci.yml

@@ -105,11 +105,16 @@ jobs:
         if: steps.check.outputs.present == 'true'
         with:
           node-version: '22'
-      - name: web-ext lint
+      - name: eslint (no-download-logic gate + general rules)
         if: steps.check.outputs.present == 'true'
         working-directory: extension
         run: |
           npm ci
+          npx eslint .
+      - name: web-ext lint
+        if: steps.check.outputs.present == 'true'
+        working-directory: extension
+        run: |
           npx web-ext lint --source-dir .
 
   # --- build + test matrix ----------------------------------------------------------