feat: package Dotdog as a Spec Kit community extension

[logohere]

Summary

Add a GitHub Spec Kit community extension wrapper for Dotdog with three namespaced commands:

• speckit.dotdog.import
• speckit.dotdog.inspect
• speckit.dotdog.serve

The extension declares Dotdog 0.9.0 and Spec Kit 0.12.0 compatibility, includes an .extensionignore allowlist, and documents installation from a versioned release asset.

Compliance

• schema version 1.0 manifest
• lowercase extension and command identifiers
• semantic version aligned with the Dotdog package
• HTTPS repository/homepage metadata
• required README, LICENSE, changelog, commands, and documentation
• category docs, effect read-write
• no automatic hooks

Security

• commands operate only in the current Spec Kit project root
• user arguments are never interpolated into shell commands
• arbitrary paths, flags, shell substitutions, redirects, and separators are rejected
• no network calls, credential use, elevated privileges, or background persistence
• MCP remains local stdio only
• compliance checker rejects symlinks, path traversal, unsafe command patterns, malformed metadata, and unpinned release actions
• CI uses read-only permissions, pinned action SHAs, frozen dependencies, and timeouts
• release workflow requires the release branch to point exactly at main, builds a deterministic ZIP, publishes a SHA-256 checksum, and refuses to replace an existing release

Verification

• node scripts/check-speckit-extension.mjs
• full Dotdog test workflow
• deterministic extension release workflow restricted to release/spec-kit-extension-v*

Release follow-up

After merge, create the release branch for v0.9.0. The release workflow will create the versioned extension ZIP and checksum from the exact main commit. Then test installation and submit the GitHub Spec Kit Extension Submission issue.

No npm publish is included in this PR.

[logohere]

Final review complete.

• manifest follows the current GitHub Spec Kit 1.0 schema and command namespace rules
• command files have valid frontmatter and bounded local-only instructions
• .extensionignore limits installed content to the extension package instead of copying the full repository
• extension/package versions match at 0.9.0
• CI passed, including the extension package validator and existing Dotdog tests/build
• no credentials, network listener, telemetry, or source Spec Kit mutation added

Ready for squash merge.