[kernel 726] fix web bot auth extension

[archandatta]

Note

Introduces enterprise policy-based installation for extensions and serves required files, improving reliability for extensions needing webRequest/webRequestBlocking.

• In UploadExtensionsAndRestart, detect policy-required extensions, extract Chrome extension ID from update.xml, validate presence of update.xml and .crx, update enterprise policy, and only add --load-extension flags for non-policy extensions
• Extend policy model: add ExtensionInstallForcelist, use update_url instead of local path, dedupe forcelist entries, and add ExtractExtensionIDFromUpdateXML with ID validation
• Serve http://.../extensions/* from /home/kernel/extensions so Chrome can fetch update.xml and .crx
• E2E: add TestWebBotAuthInstallation verifying ExtensionInstallForcelist and extension directory
• Docker: make /chromium/flags bind mount writable

^{Written by Cursor Bugbot for commit 46a6e1e. This will update automatically on new commits. Configure here.}

[rgarcia]

Good progress on the Chrome enterprise policy implementation. The core logic for separating policy vs non-policy extensions looks solid.

Main concern: the deleted TestWebBotAuthInstallation test should be updated rather than removed - the new flow has significant behavior changes that warrant e2e coverage.

A few minor nits on style/perf, and a question about whether the /update.xml root route is necessary.

[rgarcia]

this test was verifying the web-bot-auth policy installation flow. rather than deleting it, could we update it to test the new behavior? the new flow (requiring update.xml + .crx, ExtensionInstallForcelist, update_url instead of path) seems important enough to have e2e coverage.

[rgarcia]

Changes since last review look good:

• All nits addressed (idiomatic error declaration, strings.HasPrefix, package-level regex)
• Removed non-deterministic /update.xml and /{filename}.crx routes
• Re-added TestWebBotAuthInstallation with proper update.xml and .crx files
• RuntimeAllowedHosts removal is correct - matches upstream web-bot-auth reference and force-installed extensions get manifest permissions automatically

Ship it 🚀