feat(extension): dispatch unknown top-level commands to installed extensions

[margaretjgu]

Summary

Closes #297. Part of #222. Depends on #302.

• Adds src/extension/runner.ts with runExtension(ext, args, contextEnv): spawns the extension entrypoint with shell: false, merges context env vars into the inherited environment, and resolves with the child's exit code
• Updates cli.ts: after all built-in commands are registered, checks whether firstArg matches any of the known built-in command names; if not, looks up the extension registry and execs the extension, forwarding remaining argv and the resolved context env vars
• Unknown commands with no matching extension fall through to Commander's normal error handling

Security: spawn is called with shell: false and an explicit args array. The entrypoint path is validated by store.ts to be an absolute path within the install directory before it is ever written to the registry.

Test plan

• npx tsc --noEmit passes clean
• elastic some-unknown-cmd still errors normally when no extension is installed
• elastic local dispatches to elastic-local binary after elastic extension install github:elastic/elastic-local (functional)
• Extension receives ELASTIC_ES_URL and ELASTIC_ES_API_KEY in its environment

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	6.57s
✅ REPOSITORY	gitleaks	yes		no	no	91.66s
✅ REPOSITORY	git_diff	yes		no	no	0.44s
✅ REPOSITORY	secretlint	yes		no	no	23.2s
✅ REPOSITORY	trivy	yes		no	no	15.92s
✅ TYPESCRIPT	eslint	8		0	0	3.49s

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository