fix(extensions): harden GitHub extension installs

[DrHepa]

Summary

• Add strict extension ID validation and canonical root confinement for GitHub install, repair, and uninstall paths.
• Roll back failed GitHub installs so broken extensions are not left in the final extensions directory.

Security context

This addresses local filesystem safety around GitHub extension installation. I am intentionally keeping the report concise here and can share additional details privately if preferred.

Changes

File	Change
electron/main/extension-path-guard.ts	Adds reusable extension ID validation and root-confined path resolution helpers.
electron/main/extension-path-guard.test.ts	Covers valid IDs, traversal attempts, absolute paths, separators, and backup path confinement.
electron/main/ipc-handlers.ts	Applies guarded paths to install/repair/uninstall and restores/removes failed installs.

Test Plan

• node --test electron/main/extension-path-guard.test.ts
• Attempted tsc --noEmit -p tsconfig.node.json; current upstream branch fails on pre-existing electron/main/python-bridge.ts nullability errors unrelated to this patch.