feat: port to Python and package as pip-installable distribution

Replaces main.sh with the 'cli-gnome-extension-manager' distribution in a src layout, shipping both the cli-gnome-extension-manager and the older goexma command.

sync_repository keeps the three states of the shell original apart: clone when the folder is missing, pull when it is a checkout, leave it alone otherwise, so a manually installed extension is never overwritten. build_extension still moves the checkout away before make install, but into a TemporaryDirectory instead of a fixed /tmp/<name>, which removes the collision between parallel runs and cleans up on abort.

Every step passes through the exit code of the failing tool, replacing the shell chain of || exit 1; a missing gnome-extensions aborts with exit 127. The e2e suite builds a real git repository, clones it with real git and runs real make install.

Adds --extensions-dir, unit, integration and container-based e2e tests, ruff and markdown/mermaid linting, CodeQL and Dependabot, and pins the core metadata to 2.4 so twine accepts the artifacts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/test_cli.py

@@ -0,0 +1,96 @@
+import unittest
+from unittest import mock
+
+from gnome_extension_manager.cli import main
+
+
+class TestMain(unittest.TestCase):
+    def _patched(self, **returns):
+        return (
+            mock.patch(
+                "gnome_extension_manager.cli.sync_repository",
+                return_value=returns.get("sync", 0),
+            ),
+            mock.patch(
+                "gnome_extension_manager.cli.build_extension",
+                return_value=returns.get("build", 0),
+            ),
+            mock.patch(
+                "gnome_extension_manager.cli.gnome_extensions",
+                return_value=returns.get("toggle", 0),
+            ),
+        )
+
+    def test_disable_only_toggles(self):
+        sync, build, toggle = self._patched()
+        with sync as sync_mock, build as build_mock, toggle as toggle_mock:
+            exit_code = main(["disable", "ext@example"])
+
+        sync_mock.assert_not_called()
+        build_mock.assert_not_called()
+        toggle_mock.assert_called_once_with("disable", "ext@example")
+        self.assertEqual(exit_code, 0)
+
+    def test_enable_without_repository_skips_installation(self):
+        sync, build, toggle = self._patched()
+        with sync as sync_mock, build as build_mock, toggle as toggle_mock:
+            exit_code = main(["enable", "ext@example"])
+
+        sync_mock.assert_not_called()
+        build_mock.assert_not_called()
+        toggle_mock.assert_called_once_with("enable", "ext@example")
+        self.assertEqual(exit_code, 0)
+
+    def test_empty_repository_argument_is_treated_as_absent(self):
+        sync, build, toggle = self._patched()
+        with sync as sync_mock, build, toggle:
+            exit_code = main(["enable", "ext@example", ""])
+
+        sync_mock.assert_not_called()
+        self.assertEqual(exit_code, 0)
+
+    def test_enable_with_repository_installs_into_the_extensions_dir(self):
+        sync, build, toggle = self._patched()
+        with sync as sync_mock, build as build_mock, toggle:
+            exit_code = main(
+                [
+                    "enable",
+                    "ext@example",
+                    "https://example.com/ext.git",
+                    "--extensions-dir",
+                    "/opt/ext",
+                ]
+            )
+
+        folder = sync_mock.call_args.args[0]
+        self.assertEqual(str(folder), "/opt/ext/ext@example")
+        build_mock.assert_called_once()
+        self.assertEqual(exit_code, 0)
+
+    def test_failed_clone_stops_before_building(self):
+        sync, build, toggle = self._patched(sync=128)
+        with sync, build as build_mock, toggle as toggle_mock:
+            exit_code = main(["enable", "ext@example", "https://example.com/ext.git"])
+
+        build_mock.assert_not_called()
+        toggle_mock.assert_not_called()
+        self.assertEqual(exit_code, 128)
+
+    def test_failed_build_stops_before_enabling(self):
+        sync, build, toggle = self._patched(build=2)
+        with sync, build, toggle as toggle_mock:
+            exit_code = main(["enable", "ext@example", "https://example.com/ext.git"])
+
+        toggle_mock.assert_not_called()
+        self.assertEqual(exit_code, 2)
+
+    def test_failed_toggle_propagates(self):
+        sync, build, toggle = self._patched(toggle=1)
+        with sync, build, toggle:
+            exit_code = main(["enable", "ext@example"])
+
+        self.assertEqual(exit_code, 1)
+
+
+if __name__ == "__main__":
+    unittest.main()