ci: automate Firefox releases, keep Chrome manual

[ShiosOS]

Summary

The Release workflow already had store-publishing steps for both stores, but neither would actually have published. This resolves them in opposite directions: Firefox gets automated, Chrome stays manual.

Chrome was broken and isn't worth fixing. The step never set PUBLISHER_ID, which chrome-webstore-upload lists in requiredFields because the Web Store v2 API addresses items as publishers/<publisherId>/items/<extensionId> — so the first upload would have failed. Making it work means standing up a Google Cloud OAuth client and carrying a refresh token that Google revokes on its own schedule (after 7 days while the consent screen sits in Testing). That's recurring upkeep in exchange for a two-minute drag-and-drop a few times a year. Dropped the step and documented the manual process.

Firefox was publishing to the wrong place. --channel unlisted is self-hosted distribution: a signed .xpi on the GitHub Release, no public listing. Switched to listed so releases reach addons.mozilla.org.

Changes

• release.yml: web-ext sign --channel unlisted → --channel listed
• release.yml: pin fail_on_unmatched_files: false — listed submissions return no signed file, so dist/*.xpi now matches nothing and must warn rather than fail the release
• release.yml: remove the Chrome Web Store step, with a comment recording why it stops at Firefox
• package.json: drop the now-unused chrome-webstore-upload-cli dev dependency
• RELEASING.md: new Chrome: manual release section (per-release upload steps + one-time setup); document the one-time AMO listing submission that the listed channel requires; drop the five CHROME_* secrets and the OAuth troubleshooting
• CHANGELOG.md: note both under [Unreleased]

Testing

• npm run check passes (format, lint, type-check, web-ext lint, tests — 64 passing)
• npm run build produces a working package (dist/copy-pr-link-v0.1.0.zip)
• Manually loaded the extension and verified copying on a GitHub PR page — not applicable, no extension code changed

Notes

⚠️ Merge order matters. AMO_JWT_ISSUER / AMO_JWT_SECRET are already set, so the AMO step activates on the next release. On the listed channel web-ext sign updates an existing listing and can't create one, so the one-time AMO submission documented in RELEASING.md needs to happen before the next release — otherwise the step fails with no add-on to update.

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.