Feat v0.6.12 extension css isolation

Prefix enforcement prevents extension CSS from leaking into the kernel
or sibling extensions. All 12 in-tree packages migrated to .ext-{slug}-*
naming convention.

- Add data-ext attribute to extension mount container
- Add CSS linter (scripts/lint-package-css.sh) enforcing .ext-{slug} prefix
- Add kernel CSS contract doc (docs/EXTENSION-CSS.md)
- Migrate 12 packages: chat, dashboard, editor, git-board, hello-dashboard,
  icd-test-runner, notes, schedules, sdk-test-runner, tasks,
  team-activity-log, workflow-demo (CSS + JS in lockstep)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/icd-test-runner/js/tier-sdk.js

@@ -337,7 +337,7 @@
     await T.test('sdk', 'pipe-render', 'Render filter modifies DOM', async function () {
       sw.pipe.render(1, function (ctx) {
         if (ctx.element.dataset.sdkRenderTest) {
-          ctx.element.classList.add('sdk-render-modified');
+          ctx.element.classList.add('ext-icd-test-runner-sdk-render-modified');
         }
         return ctx;
       }, { source: '_test-render-dom' });
@@ -348,7 +348,7 @@
         element: el, message: null,
         channel: { id: 'fake', type: 'direct' }
       });
-      T.assert(el.classList.contains('sdk-render-modified'), 'element should have class');
+      T.assert(el.classList.contains('ext-icd-test-runner-sdk-render-modified'), 'element should have class');
     });
 
     await T.test('sdk', 'pipe-render', 'Priority ordering in render chain', async function () {