Pin the gnome-shell appindicator extension to a specific ubuntu upstream
commit and download an immutable tarball URL. Verify the downloaded
archive's SHA-256 (refuse to proceed if sha256sum/shasum is missing or
the checksum mismatches) and only extract when verification succeeds.
Add quoting for $username in sudo/mkdir invocations and preserve the
staging/copy workflow for user-owned extension installation. For the
InstallRemoteExtension flow on other distros, add a 90s polling timeout
when waiting for metadata.json and surface an error on timeout to avoid
hanging indefinitely.
Allen Houchins
69840387f0