feat(deploy): package and sign Firefox releases for Mozilla Add-ons #428

Firefox marketplace release path and the matching site changes. The Firefox build support (#173) has landed.

Site #

Before / after the homepage:

• The hero keeps the Chrome Web Store sticker and adds a quiet Mozilla Add-ons line under it; the intro names both stores.
• The privacy policy's store-analytics sentence now covers both stores.
• The AMO slug (addons.mozilla.org/firefox/addon/substandard/) is a placeholder until the listing exists, recorded in TODO.md.

Release path #

scripts/deploy-firefox.sh:

• Preflight: clean tree, npm ci, typecheck, tests, hosted OAuth metadata check (the Firefox redirect URI must be live before signing).
• Version agreement, and the release tag must already point at HEAD — same policy as deploy-ext.sh.
• npm run package:firefox (build + verify dist-firefox).
• web-ext lint against the build: the marketplace's own linter.
• Zip the contents at the archive root.
• If WEB_EXT_API_KEY / WEB_EXT_API_SECRET are set, sign with web-ext sign (AMO_CHANNEL=unlisted for self-distribution, default listed); otherwise stop with the uploadable zip and the AMO submit URL.

The README has the maintainer steps, including the store-assets distinction: AMO's listing copy and screenshots are its own, not a drop-in from the Chrome listing.

Verification #

• bash -n scripts/deploy-firefox.sh
• npm run check
• npm test — 481 passed
• npm --prefix web ci && npm --prefix web run build — site builds.
• The script's Firefox build/lint/sign steps were not run here because this branch does not carry the Firefox build target yet and there are no AMO credentials; #173 covers the build, and signing is a release-time step.