read off the built package, as `value.reviewRisks` plus one warning
  each with the fix: access to every website, code the package did not
  ship (`eval`, `new Function`, scripts or imports loaded from a URL), a
  Firefox manifest without `data_collection_permissions`, and API
  permissions no shipped script uses. They never block a build. On a
  dev build only the manifest checks run, because the hot-reload runtime
  and the injected `management` permission are not what a store
  receives (measured on seven published extensions' dev builds against a
  production build of an official template).

- The bundled `/extension-publish` command now takes an extension through
  store review with this server's own tools instead of sending people to
  the store consoles by hand: it validates, builds, checks for review
  risks, rehearses with `extension_submit` (dry run), and submits only on
  the user's yes through the approval link. It covers Chrome, Firefox,
  Edge and Safari, and keeps whatever manifest version the project
  declares rather than migrating it during a submission.