v7.0.0

preview.extension.dev is the only web door this package knows about. The
inspect door predates it and had stopped being reachable.

Removed

• extension_preview_web no longer takes surface or inspectUrl.
  surface:"inspect" pointed a local build at inspect.extension.dev over the
  inspect://path scheme, which is what the tool did before
  preview.extension.dev existed. Only the inspect dev server ever answered it:
  the deployed origin serves store listings and has no /__inspect/fetch, so
  the door resolved on one machine and nowhere else. Every build now renders in
  preview.extension.dev, which is also the surface that carries the
  Emulated/Real lane toggle and the Trace tab. The response no longer carries a
  surface field, and hostUrl is the only origin override.
• The carrier no longer allowlists inspect.extension.dev. Pairing needs a
  page that opens the bridge, and inspect never did: it traces the emulated lane
  of the extension it fetched and has no lane toggle. extension_dev
carrier: true and the pairing notes now point at preview.extension.dev,
  and the carrier's externally_connectable drops the origin that was never
  going to connect.
• extension_login no longer falls back to the GitHub device flow.
  extension.dev hosts the device flow itself and federates GitHub server-side, so
  the only authorization surface is extension.dev/device and no GitHub token
  ever lands on the caller's machine. The legacy path is gone entirely: the
  GitHub device-code client, the provider fork (which existed twice, once in the
  tool and once in the extension-mcp login bin), the
  /api/cli/login/exchange hop, and the EXTENSION_DEV_GITHUB_CLIENT_ID
  override. Stored credentials record provider: "extensiondev" and
  extension_whoami reports that instead of defaulting to "github". Nothing
  changes for a caller who was already on the branded flow, which is every caller
  the platform has served since it went live; a self-hosted platform pinned to
  the old exchange endpoint is no longer supported.