docs: plan local-only extension inventory

[gugu91]

Summary

• Adds a public-safe planning doc for issue plan: safely inventory local-only extensions #671.
• Defines read-only inventory phases, sanitized public reporting, disposition criteria, security/privacy review gates, packaging shape, and future test strategy.
• Keeps the PR planning-only: no local extension code, private paths, logs, screenshots, or user-specific configuration are copied.

Checks

• pnpm exec prettier --check plans/671-local-only-extension-inventory.md
• pnpm lint
• pnpm typecheck
• pnpm test

Closes #671

[gugu91]

Code-reviewer result: Approve.

Reviewed plans/671-local-only-extension-inventory.md against issue #671 confidentiality guardrails and requested planning bullets. No critical issues, warnings, or suggestions. The PR remains planning-only and public-safe: no local extension code, private paths, secrets, workspace names, private URLs, screenshots, logs, or user-specific configuration are copied.

Reviewer checks included targeted Markdown formatting and whitespace validation.

[gugu91]

CI note: the quality workflow did not start because GitHub reported an account billing lock. Local verification completed successfully (prettier --check for the new plan, pnpm lint, pnpm typecheck, and pnpm test). No code/test failure is visible from the CI annotation.

[will-jack-and-jilll]

Will's reviewer agent Quill Badger

Verdict

• Approve
• Planning-only diff, public-safe content, and no merge blockers. The lone failing GitHub check is a billing-lock job non-start, not a code/test failure, and the locally reported validation re-passed when I re-ran it.

Review Scope

• PR reviewed: #674 #674
• Files examined: plans/671-local-only-extension-inventory.md; issue #671; PR body/comments/check annotation
• Commands run: gh pr view 674, gh issue view 671, git diff origin/main...HEAD -- plans/671-local-only-extension-inventory.md, gh api repos/gugu91/extensions/check-runs/73919808877/annotations, pnpm exec prettier --check plans/671-local-only-extension-inventory.md, pnpm exec turbo run lint --force --output-logs=errors-only, pnpm exec turbo run typecheck --force --output-logs=errors-only, pnpm exec turbo run test --force --output-logs=errors-only

Findings

Critical (must fix)

• None

Warnings (should fix)

• None

Suggestions (consider)

• None

Checklist

• Correctness: pass — covers the requested planning scope from #671 without introducing implementation changes.
• Architecture & maintainability: pass — clear phased plan, decision criteria, and follow-up slices.
• Security & reliability: pass — strong confidentiality and pre-migration review guardrails.
• Tests & verification: pass — GitHub Actions failed because the job never started (account is locked due to a billing issue); local prettier --check, uncached repo lint, typecheck, and test all succeeded.

Summary

• One-file docs-only PR; no runtime behavior changed.
• The plan is public-safe and avoids exposing local paths, secrets, or user-specific configuration.
• The requested inventory/migration/privacy/testing guidance is covered end to end.
• Approving under the maintainer guidance to ignore CI when billing lock prevents the workflow from starting.