chore: harden extension privacy defaults and release workflow

[pedrosousa13]

Summary

• Make window.data exposure opt-in via Settings instead of default-on, and make the page script remove the in-page JSON holder after reading it.
• Keep broad content-script matching for automatic JSON viewing.
• Preserve the existing Remember queries & searches control as default-on local storage with a Settings opt-out, and add regression coverage so that behavior does not drift.
• Remove the release workflow entirely so GitHub Actions only runs checks.

Branch comparison

• Started from updated origin/main at e48e4df.
• Cherry-picked the relevant fix/window-data-opt-in commits for the opt-in window.data flow.
• Skipped unrelated fix/window-data-opt-in contents like planning/store-listing files.

Manual testing

1. Build and load the extension from dist:
   • Run npm run build.
   • Open Chrome chrome://extensions, enable Developer mode, click Load unpacked, and select this repo's dist folder.
2. Open a JSON response, for example https://jsonplaceholder.typicode.com/users.
   • Confirm JSON Bonsai replaces the plain JSON page with the viewer.
   • Open DevTools Console and confirm window.data is undefined before opting in.
3. Open Settings (gear icon).
   • Confirm Expose payload as window.data is unchecked by default.
   • Check it, reload the JSON page, and confirm window.data contains the parsed payload in the page console.
   • In Elements, confirm #jv-json-data does not linger after the page script runs.
   • Uncheck the setting, reload, and confirm window.data is no longer set by JSON Bonsai.
4. Test the pre-existing query/search persistence option.
   • Confirm Remember queries & searches is checked by default.
   • Run a query and a search, reload the same origin, and confirm the query/search history is restored.
   • Uncheck Remember queries & searches, run a different query/search, reload, and confirm the new query/search is not restored.
5. Check workflow scope.
   • Confirm .github/workflows/ci.yml is the only workflow file.
   • Confirm CI still runs typecheck, unit tests, build, and E2E checks.
   • Confirm there is no release workflow and no browser-store publishing automation.

Verification

• npm run typecheck
• npm test (17 files, 214 tests)
• npm run build
• npm run test:e2e (30 tests)
• npm audit --json (0 vulnerabilities)