site-theseus-x/extensions: Install + Download buttons on the bundled cards

Every card that has a signed update channel now carries the two
buttons a reader actually needs — "Install in Theseus" (a
theseus://extensions/install/<id> deep link that main.js already
intercepts via will-navigate, popping the native install-consent
dialog and verifying the operator signature before any bytes hit
addons/) and "Download tarball" (direct .tar.gz link for sideloaders
and archivists). A one-line update hint below the buttons points at
the signed updates.json and notes SHA-256 verification, so the whole
install-and-then-update path fits inside the card.

Applies to Screenshot and PDF Editor. Notepad and Translate ship
inside every Theseus build and have no separate channel yet — those
carry a plain "Ships with Theseus — appears under Settings ›
Extensions on first launch" note in the same slot so the layout
stays consistent across bundled entries.

The download hrefs default to the current versioned tarball on the
navigate.st gateway and get rewritten to the newest entry from the
signed updates.json when the fetch succeeds (new data-live="download"
setter on the manifest-fill script) so the button never points at a
stale version.

extensions/index.html

@@ -96,6 +96,11 @@
   .ext .h b{color:var(--mut);font-weight:600;min-width:70px}
   .ext .h code{font-family:ui-monospace,monospace;font-size:10.5px;color:#c9d4e3;word-break:break-all;background:transparent;border:none;padding:0}
   .ext .meta{color:var(--dim);font-size:12.5px;margin-top:.4rem}
+  .ext .act .download{display:inline-block;padding:9px 14px;border-radius:9px;text-decoration:none;
+       font-size:13.5px;font-weight:600;background:transparent;color:var(--ink);border:1px solid var(--line)}
+  .ext .act .download:hover{background:var(--panel)}
+  .ext .act .hint{color:var(--dim);font-size:11.5px;margin-left:auto;flex-basis:100%}
+  .ext .act .hint b{color:var(--mut);font-weight:500}
   .ext .act{display:flex;align-items:center;gap:12px;flex-wrap:wrap;margin-top:.8rem}
   .ext .install{display:inline-block;background:var(--acid);color:#0b0e14;font-weight:600;font-size:14px;
        border:none;border-radius:9px;padding:9px 18px;cursor:pointer;text-decoration:none;font-family:inherit}
@@ -181,6 +186,11 @@
       you draw. The capture opens in a full-tab editor: crop, annotate, line tool, resizable text,
       redact, save.</div>
     <div class="meta">Settings › Extensions · <span data-live="count"></span></div>
+    <div class="act">
+      <a class="install" href="theseus://extensions/install/screenshot" data-install="screenshot">Install in Theseus</a>
+      <a class="download" data-live="download" href="https://navigate.st/bns/theseus.x/extensions/screenshot/screenshot-0.6.5.tar.gz" download>Download tarball</a>
+      <div class="hint">Updates: signed <a href="./screenshot/updates.json">updates.json</a> · SHA-256 verified before every install</div>
+    </div>
     <div class="verifybox">
       <div class="lbl">Signed update manifest — SHA-256 verified before install</div>
       <div class="h"><b>updates.json</b><code><a href="./screenshot/updates.json">theseus.x/extensions/screenshot/updates.json</a></code></div>
@@ -193,6 +203,9 @@
     <h3><span class="icon">📝</span> Notepad <span class="cur" style="margin-left:auto">bundled 0.1.0</span></h3>
     <div class="desc">Right-sidebar notes. Text lives on this machine only and autosaves as you type.</div>
     <div class="meta">Settings › Extensions · no update channel yet — ships with each Theseus release.</div>
+    <div class="act">
+      <span class="hint" style="margin-left:0"><b>Ships with Theseus</b> — nothing to install; appears under Settings › Extensions on first launch.</span>
+    </div>
   </div>
 
   <div class="ext" id="translate">
@@ -200,6 +213,9 @@
     <div class="desc">Select text on any page and right-click <i>Translate</i> — the sidebar panel shows the translation,
       with LibreTranslate or Google as the backend (your choice in the panel). Nothing is sent until you ask.</div>
     <div class="meta">Settings › Extensions · no update channel yet — ships with each Theseus release.</div>
+    <div class="act">
+      <span class="hint" style="margin-left:0"><b>Ships with Theseus</b> — nothing to install; appears under Settings › Extensions on first launch.</span>
+    </div>
   </div>
 
   <div class="ext" id="pdf-editor" data-ext="pdf-editor">
@@ -209,6 +225,11 @@
       is never touched. Opens from the toolbar's PDF Editor menu or the right-click <i>Open PDF in editor</i>
       on any link.</div>
     <div class="meta">Settings › Extensions · <span data-live="count">signed update channel</span></div>
+    <div class="act">
+      <a class="install" href="theseus://extensions/install/pdf-editor" data-install="pdf-editor">Install in Theseus</a>
+      <a class="download" data-live="download" href="https://navigate.st/bns/theseus.x/extensions/pdf-editor/pdf-editor-0.1.0.tar.gz" download>Download tarball</a>
+      <div class="hint">Updates: signed <a href="./pdf-editor/updates.json">updates.json</a> · SHA-256 verified before every install</div>
+    </div>
     <div class="verifybox">
       <div class="lbl">Signed update manifest — SHA-256 verified before install</div>
       <div class="h"><b>updates.json</b><code><a href="./pdf-editor/updates.json">theseus.x/extensions/pdf-editor/updates.json</a></code></div>
@@ -282,6 +303,7 @@
       set("version", (el) => { el.textContent = top.version; });
       set("sha256", (el) => { el.textContent = top.sha256 || "—"; });
       set("url", (el) => { el.href = top.url; el.textContent = String(top.url).split("/").pop(); });
+      set("download", (el) => { if (top.url) el.href = top.url; });
       set("count", (el) => { el.textContent = list.length + " signed version" + (list.length === 1 ? "" : "s") + " on the channel"; });
     } catch {}
   }