[P2][SDK-01] Sandboxed extension host and manifests

Programme: #1
Epic: #32

## Objective
Provide a safe execution surface for third-party/generated extensions with explicit manifests, narrow host APIs and enforceable resource/capability limits.

## Scope
- WASM-compatible extension runtime (Wasmtime-class) for supported extension types.
- Manifest: package identity/version/signature, entrypoints, host imports, files, network destinations, workspace/resource types and capabilities requested.
- Capability handles rather than ambient host APIs.
- CPU/memory/time/concurrency budgets and deterministic termination.
- Sandboxed custom UI workers/components communicating through validated message schemas.
- Extension storage namespace and migration lifecycle.
- Crash isolation, disable/revoke and diagnostic traces.

## Security rules
- Extension sandbox is not a substitute for native CLI confinement.
- No undeclared filesystem/network/secret access.
- Extension UI cannot impersonate trusted shell/approval controls.

## Acceptance criteria
- [ ] Untrusted extension cannot access undeclared files, destinations or host imports.
- [ ] CPU/memory/time abuse terminates the extension without freezing the shell.
- [ ] Capability requests are visible/reviewable before activation.
- [ ] Extension crash does not corrupt workspace or trusted runtime state.
- [ ] Revoked/disabled package cannot execute new work.
- [ ] Host API/version compatibility is covered by conformance fixtures.

## Dependencies
- SEC-04
- UI-01

**First phase:** P2
**Maturity target:** P5
**Owner:** platform

Start by reviewing the SEC-04 and UI-01 dependencies alongside the stated scope and security rules. Treat the acceptance criteria as the completion checklist: enforce declared capabilities and resource limits, isolate crashes, support revocation, and cover host API compatibility with conformance fixtures.

Written by the indexing model from the issue text.