ext: no-download-logic ESLint gate in the extension-lint CI job

CLAUDE.md §3's rule was prose only for extension/ (GUI already has
gui_no_download_logic as a ctest). eslint.config.mjs adds a
no-restricted-syntax/no-restricted-globals rule banning fetch/XHR/Request,
ReadableStream.getReader, Range/Content-Range header construction, and
IndexedDB in src/**/*.ts. Verified red on a planted violation (fetch +
Range header + stream reader) and green on ordinary code; that check is
now a permanent regression test (tests/lint/no-download-logic.test.ts)
rather than a one-off manual run. Wired into the existing extension-lint
job in .github/workflows/ci.yml, ahead of web-ext lint.

Generated protocol code (src/shared/protocol/**) is excluded from lint
entirely — it must never be hand-edited, so flagging it as fixable would
be a lie.

Answers gui/docs/ext-requests-m1.md.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Ed8KEmAW48v4YHdxLtqsMB

extension/package.json

@@ -10,13 +10,18 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "lint": "web-ext lint --source-dir ."
+    "lint": "npm run lint:eslint && npm run lint:webext",
+    "lint:eslint": "eslint .",
+    "lint:webext": "web-ext lint --source-dir ."
   },
   "devDependencies": {
     "@types/firefox-webext-browser": "^120.0.4",
     "@types/ws": "^8.5.12",
     "esbuild": "^0.24.0",
+    "eslint": "^9.39.5",
+    "happy-dom": "^15.11.7",
     "typescript": "^5.6.0",
+    "typescript-eslint": "^8.70.0",
     "vitest": "^2.1.0",
     "web-ext": "^8.3.0",
     "ws": "^8.18.0"