feat(extension): add Chrome MV3 tombstone badge for GitHub repo pages

[mvanhorn]

Summary

Closes #14. Adds a Manifest V3 Chrome extension under extension/ that injects a 🪦 "Declared Dead — View Certificate" badge near the repo title on any github.com/<owner>/<repo> page where commitmentissues.dev/api/repo reports deathIndex >= 6. Click takes the user to the certificate at commitmentissues.dev/?repo=<owner>/<repo>.

Why this matters

Issue #14 spelled out the UX: developers don't always remember to check commitmentissues.dev before they evaluate a dependency. A passive in-place badge surfaces the verdict at the moment they're already on the repo page, with zero friction to dig deeper if they care.

Changes

• NEW extension/manifest.json — MV3, content-script-only. host_permissions is just https://commitmentissues.dev/* (no broad <all_urls>); matches: ["https://github.com/*"]. No background service worker per the issue's MVP scope.
• NEW extension/content.js — single self-invoking module:
  • parseRepoFromPath peels owner/repo out of /owner/repo/.... It excludes GitHub's reserved top-level paths (orgs, settings, explore, topics, trending, events, sponsors, marketplace, pricing, etc.) and per-user reserved second segments (followers, following, projects, tabs) so org pages and profile sub-pages don't get a badge.
  • findRepoTitleAnchor tries three known-stable selectors (strong[itemprop="name"] a, h1 strong[itemprop="name"] a, h1 a[data-pjax="#repo-content-pjax-container"]) so we degrade gracefully if GitHub tweaks one.
  • fetchDeathIndex calls /api/repo?url=<gh url> with AbortSignal.timeout(4000) (with a polyfill fallback), then reads body.deathIndex. Anything non-numeric, non-200, or thrown -> silent skip.
  • tryInject removes any prior badge, short-circuits when lastInjectedFor === fullName, runs the fetch, and re-checks the URL after the await so we don't drop a stale badge if the user navigated mid-fetch.
  • observeNavigation listens for popstate + pjax:end + turbo:load + turbo:render and adds a MutationObserver on document.body that re-fires on href change. SPA navigation in either direction triggers a fresh tryInject.
• NEW extension/icon.png — copy of src/app/icon.png per the issue's "reuse src/app/icon.png" note. Used as both the 32px and 128px icon in the manifest.
• README.md — adds a "Browser extension" section with the 5-step load-unpacked instructions per the acceptance criteria.

Acceptance criteria

• Badge appears on dead repos (deathIndex >= 6), not on active ones — both null/missing and < 6 paths exit silently before insertion.
• No badge on non-repo GitHub pages — reserved top-level + second-segment lists are checked before any fetch.
• No duplicate badge on SPA navigation — existing badge is removed at the start of each tryInject, and lastInjectedFor short-circuits identical re-renders.
• API unavailable -> graceful silence — fetch is wrapped in a try/catch, non-200 returns null, timeout returns immediately.
• Works in Chrome 114+ (MV3) — manifest_version: 3, AbortSignal.timeout (Chrome 103+).
• Load-unpacked instructions in README updated.

Testing

• python3 -c "import json; json.load(open('extension/manifest.json'))" — valid JSON.
• node --check extension/content.js — clean.
• Manual smoke test: loaded unpacked, visited a few known-dead and known-live repos to confirm the inject-once-and-link behavior. Org and profile pages remained un-badged. Forward/back navigation between repos correctly removed the old badge and (when applicable) inserted the new one.

This contribution was developed with AI assistance (Claude Code).

[vercel]

@mvanhorn is attempting to deploy a commit to the Dotsystems 9999 Team on Vercel.

A member of the Team first needs to authorize it.

[dotsystemsdevs]

Tack @mvanhorn — clean MV3 setup, minimal permissions (only host_permissions för commitmentissues.dev), graceful fallback på SPA-navigation och API-fel. Mergat. 🪦

[mvanhorn]

Tack själv! Glad it landed cleanly. 🪦