Template
Extension discovery (plan todo 20): scans --ext-dir dirs, STUPIDTOOLS_EXT, the XDG user dir and a builtin-ext dir for *.lua modules, runs each in the sandboxed Lua runtime, and enumerates its registrations; the builtin C/C++ modules load first via st_ext_init_builtins. Fail-fast with an error naming file and line on any malformed/sandbox-violating module. The CLI gains a repeatable --ext-dir flag; with flag or env present main.c runs discovery and prints 'loaded extension: ...' lines from actual registrations (interim wiring until todo 23). Note: src/Makefile.am gained the ext + vendored Lua sources because the binary otherwise cannot link discovery -- required for the root-verifiable CLI acceptance.