fix(extensions): apply GHES auth and resolve release assets for extension add --from

[mnriem]

Problem

specify extension add <name> --from <GHES-url> does not apply configured GHES authentication when downloading the ZIP. It received an HTML login page instead of the binary and failed with zipfile.BadZipFile at install_from_zip. Both the catalog and asset URLs are valid and return correct content when auth is applied (verified via curl with a Bearer token).

Root cause

The --from path fetched the ZIP through a bare open_url(from_url) call — unlike the catalog download path (ExtensionCatalog.download_extension), it skipped:

• GitHub/GHES release-asset resolution (/releases/download/... → /api/v3/.../releases/assets/...)
• the Accept: application/octet-stream header
• any content guard

When auth didn't match (or returned 401/403), open_url silently fell through to an unauthenticated request and got a 200 HTML login page, which was written to disk and blew up as BadZipFile.

Fix

Route --from through ExtensionCatalog so it mirrors catalog installs:

• Resolve GHES release-download URLs to the authenticated /api/v3 asset API and add Accept: application/octet-stream.
• Fetch via the catalog's authenticated helper so auth.json credentials apply.
• Reject non-ZIP content (no PK magic) with a clear error pointing at auth.json, instead of an opaque BadZipFile.

This matches the equivalent fix already present for preset add --from.

Tests

• New: rejects an HTML/login page with a clear error (no BadZipFile).
• New: resolves a GHES release-download URL to /api/v3 with octet-stream Accept.
• Updated existing --from fixtures to valid ZIP magic bytes.

Full tests/test_extensions.py suite: 324 passed.

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised)