v0.6.5: Renderer pipeline, docs rewrite, architecture diagrams

Lift block rendering to kernel SDK primitives (sw.renderers + sw.markdown)
so all surfaces share one markdown pipeline. Rewrite docs for external
audience — remove all fork history references. Add Mermaid architecture
diagrams, CONTRIBUTING guide, and extension tutorial.

- sw.renderers SDK module: kernel-level renderer registry
- sw.markdown SDK module: unified marked v16 + DOMPurify pipeline
- Browser extension script loader for renderer injection
- Notes + Docs surfaces migrated to sw.markdown.renderSync()
- 4 renderer extensions rewritten to IIFE + sw.renderers.register()
- 6 Mermaid diagrams in ARCHITECTURE.md
- CONTRIBUTING.md + TUTORIAL-FIRST-EXTENSION.md
- DESIGN-WORKFLOWS.md replaces fork-era design doc
- Surface alias routes removed from main.go
- ICD/SDK runners migrated to /admin/packages/ endpoints
- 13 new renderer tests
- Docs, CHANGELOG, ROADMAP cleaned of fork references

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/pages/pages.go

@@ -104,6 +104,8 @@ type PageData struct {
 
 	ExtensionSurfaces []ExtensionNavItem `json:"-"`
 
+	BrowserExtensions []string `json:"-"` // IDs of enabled browser-tier extensions (for script injection)
+
 	InstanceName     string // branding: instance display name
 	LogoURL          string // branding: custom logo URL
 	Tagline          string // branding: tagline under instance name
@@ -178,6 +180,29 @@ func (e *Engine) extensionNavItems() []ExtensionNavItem {
 	return items
 }
 
+// browserExtensionIDs returns IDs of enabled browser-tier extensions.
+// These extensions have JS scripts that should be injected into every page
+// so they can register renderers with the SDK.
+func (e *Engine) browserExtensionIDs() []string {
+	if e.stores.Packages == nil {
+		return nil
+	}
+	ctx := context.Background()
+	pkgs, err := e.stores.Packages.List(ctx)
+	if err != nil {
+		log.Printf("[pages] Failed to load browser extensions: %v", err)
+		return nil
+	}
+
+	var ids []string
+	for _, pkg := range pkgs {
+		if pkg.Enabled && pkg.Type == "extension" && pkg.Tier == "browser" {
+			ids = append(ids, pkg.ID)
+		}
+	}
+	return ids
+}
+
 // UserContext is the authenticated user's info available to templates.
 type UserContext struct {
 	ID          string `json:"id"`
@@ -370,6 +395,7 @@ func (e *Engine) RenderSurface(surfaceID string) gin.HandlerFunc {
 			Manifest:          e.GetSurface(surfaceID),
 			EnabledSurfaces:   e.EnabledSurfaceIDs(),
 			ExtensionSurfaces: e.extensionNavItems(),
+			BrowserExtensions: e.browserExtensionIDs(),
 		})
 	}
 }
@@ -431,6 +457,7 @@ func (e *Engine) RenderExtensionSurface() gin.HandlerFunc {
 			Manifest:          manifest,
 			EnabledSurfaces:   e.EnabledSurfaceIDs(),
 			ExtensionSurfaces: e.extensionNavItems(),
+			BrowserExtensions: e.browserExtensionIDs(),
 		})
 	}
 }