feat(raycast): scaffold Gittensory Raycast extension

[kiannidev]

Add a Raycast package with GitHub Device Flow auth against the Gittensory API, local gts_ session storage, login/status/logout commands, and CI coverage.

Fixes #113

Summary

• Adds packages/gittensory-raycast — Raycast extension scaffold with Login, Status, and Logout commands.
• Authenticates via GitHub Device Flow against existing API routes (POST /v1/auth/github/device/start, POST /v1/auth/github/device/poll, GET /v1/auth/session, POST /v1/auth/logout); persists only gts_ session tokens in Raycast LocalStorage (GitHub PATs rejected at validation).
• Configurable API Origin preference (default https://gittensory-api.aethereal.dev).
• lib/ holds API client, auth polling, storage helpers, and public-output sanitizer (unit-tested, no Raycast UI imports); src/ wires Raycast commands.
• Root CI: build:raycast and test:raycast (build, lint, package tests with coverage) wired into npm run test:ci.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

Verified locally with npm run test:ci on Node v24.15.0 (repo requires Node >= 22 per .nvmrc).

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run test:raycast (new; included in test:ci)
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None.

Root coverage (npm run test:coverage): unchanged global thresholds (lines/statements/functions/branches ≥ 97%). Raycast package (npm --workspace @jsonbored/gittensory-raycast run test): lines 100%, statements 97.9%, branches 96.6%, functions 90.9% on lib/ (package-local thresholds; not merged into root src/ coverage).

New tests: packages/gittensory-raycast/test/{auth,api,config,storage,sanitize,package-boundaries,sanitize-coverage}.test.ts — auth success/failure/expiry mocks, no PAT storage, no source-upload API paths, forbidden public language sanitizer, token non-leakage on errors.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• No server/API/OpenAPI/MCP code changes; the extension is a client over existing auth endpoints (same device-flow pattern as packages/gittensory-mcp/bin/gittensory-mcp.js).
• Raycast UI proof (Import Extension → Login/Status) is manual on macOS; no web UI screenshots apply.
• Package boundaries documented in packages/gittensory-raycast/README.md.
• Load locally: cd packages/gittensory-raycast && npm install && npm run build, then Raycast → Import Extension → this directory.

[JSONbored]

@kiannidev the scaffold direction is reasonable, but Raycast still needs product evidence.

A few notes:

• Device Flow auth with gts_ session storage is the right boundary.
• The PR adds visible Login/Status/Logout commands.
• “No web UI screenshots apply” is not enough here; Raycast itself is the visible UI surface.

Required changes:

• Add screenshots Login, Status, and Logout states. (follow the raycast extension docs for exactly how screenshots should be sized/formatted/taken, as their instructions are very specific). Failure to do this will result in rejection of our Raycast extension PR submission, so this is very important.
• Keep the evidence organized in the PR description.
• Confirm no GitHub PAT storage and no secret/session output appears in command UI or logs.

Validation expected:

• Rerun the Raycast package build/tests and the root validation gates affected by the new package scripts.