feat: rebuild VCG upload helper

[KanadeK]

What changed

• restored the complete Manifest V3 extension source to the repository
• added robust CSV decoding, parsing, validation, preview, and error reporting
• rebuilt the page automation loop with single-task state, pause, immediate stop, DOM waits, and per-file results
• redesigned the popup and floating console with accessible light and dark themes
• added privacy, security, usage, contribution, release, and changelog documentation
• added zero-dependency tests, static policy checks, deterministic ZIP packaging, SHA-256 output, and GitHub Actions

Why

The previous repository contained only README and LICENSE on the default branch. The published popup script referenced missing CSV parser functions, so the public release could not start a task. Release assets were also loose files rather than a maintainable source tree or installable package.

User impact

Users can validate CSV data before touching the page, stop a task without waiting for long delays, inspect individual failures, export a report, and install one verified ZIP. The extension remains local-only and does not submit the final VCG form.

Validation

• npm run check
• 7 Node tests passed
• JavaScript syntax and permission policy checks passed
• deterministic package rebuilt with identical bytes
• light and dark popup renders inspected in headless Chrome
• package SHA-256: 8609ab97aa8d1618f4a3f07a12481bf2b5ac98b32fd4a72530b335be559c8db6