Add an exact-slug Sentry project resolver to the sentry-triage canvas (#2819)

* Fix sentry-triage canvas crash when the `sentry` package isn't bundled

Published awesome-copilot plugins ship extension source only, so the optional
`sentry` npm package the canvas depends on at runtime may be absent. Previously
that made the canvas crash on open instead of guiding the user through setup.

- Load the optional `sentry` package lazily and translate only the top-level
  ERR_MODULE_NOT_FOUND for `sentry` into a package-missing setup state; any other
  import failure (missing transitive dep, entrypoint throwing) is rethrown so a
  real defect isn't masked behind a misleading "reinstall" message.
- Add a dedicated package-missing branch to the connection preflight and a
  matching setup gate, kept distinct from the auth and transient-network gates so
  the user never sees contradictory guidance. The canvas now opens and explains
  what to do rather than crashing.
- Clear `configured` for the package-missing state so the status is no longer the
  contradictory `configured:true` + `setup:'package-missing'`.
- Tell users to sign in with the package-local CLI via `npx sentry auth login`
  run from the extension folder — the only form that resolves after a local
  `npm install`, since a package-local binary isn't on the shell PATH.
- Update the README so the sign-in step and install guidance cover the
  published-plugin layout (`com.github.copilot/extensions/sentry-triage`), not
  just the standalone user/project extension paths.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Add an exact-slug Sentry project resolver to the sentry-triage canvas

The project picker previously only offered projects from the paged list the
canvas had already loaded. Teams with many projects (or a project outside the
first page) had no way to target one by slug. This adds a verify-on-commit
resolver: when a user types a slug that isn't a local match, pressing Enter
checks it against Sentry and only commits the canonical slug once verified,
so a scan never runs against an unverified or wrong-org project.

Canvas / UX (components/page.mjs, styles.mjs):
- Autocomplete accepts an exact slug not in the local list; Enter is the
  explicit commit that triggers resolution (never an as-typed lookup).
- A visually-hidden aria-live region announces checking / verified / not
  found / couldn't-check state, and the resolved state is rendered before
  commit so screen readers hear the outcome.
- Footer/menu surfaces checking, prompt, missing, and error states, including
  when local partial matches are present.
- Project choices are read from an org-keyed cache so a slug from a previously
  selected org can never be treated as local after a free-text org switch;
  the stale-completion guard also compares the org captured for the request.

Server / resolution (server.mjs, sentry.mjs, sentryClient.mjs, extension.mjs):
- CSRF-gated /api/resolve-project verifies a single slug against Sentry.
- Resolution runs on the shared serial request chain and is hardened against
  Sentry outages and queue contention (transient errors are retryable, a
  confirmed miss is cached as "missing").

Also bumps sentry-triage to 1.1.0 (package.json, plugin.json,
marketplace.json).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

extensions/sentry-triage/server.mjs

@@ -77,7 +77,7 @@ function hasValidToken(req, token) {
   return value === token
 }
 
-export function startServer({ port = 0, onRefresh, onAction, onWorkSelected, onRecheck, onListProjects, onInvalidateEnrichment, defaults } = {}) {
+export function startServer({ port = 0, onRefresh, onAction, onWorkSelected, onRecheck, onListProjects, onResolveProject, onInvalidateEnrichment, defaults } = {}) {
   // Per-instance state + SSE clients — never shared across canvas instances.
   const state = createState()
   state.applyRepoDefaults(defaults)
@@ -241,6 +241,40 @@ export function startServer({ port = 0, onRefresh, onAction, onWorkSelected, onR
       return
     }
 
+    // Resolve a single exact "org/slug" via the SDK's project.view — an O(1)
+    // lookup that confirms a project the paged list may never reach. For a
+    // mega-org (e.g. "github" has thousands of projects) list discovery is
+    // budget-capped, so a valid slug the user types can be absent from the
+    // autocomplete; this endpoint tells the client "yes, that project exists"
+    // (with its canonical slug) without paging. Distinguishes three outcomes so
+    // the UI never shows a false negative: found, genuinely-missing, and
+    // could-not-check (network/permission) — the latter returns ok:false.
+    if (req.method === 'POST' && req.url === '/api/resolve-project') {
+      readBody(req, res).then(async (body) => {
+        if (body === null) return
+        const { org, slug } = parseJson(body)
+        const wantedOrg = typeof org === 'string' ? org : ''
+        const wantedSlug = typeof slug === 'string' ? slug.trim() : ''
+        let result = { ok: true, found: false, slug: '' }
+        try {
+          if (onResolveProject && wantedSlug) {
+            const r = await onResolveProject(wantedOrg, wantedSlug)
+            const resolved = r && typeof r.slug === 'string' ? r.slug : ''
+            result = { ok: true, found: !!(r && r.found && resolved), slug: resolved }
+          }
+        } catch (err) {
+          // A lookup failure (transient network / rate limit / permission) must
+          // NOT be reported as "project doesn't exist" — that would train the
+          // user to distrust a correct slug. Signal indeterminate with ok:false.
+          console.error('[sentry-triage] resolve-project failed:', err instanceof Error ? err.message : err)
+          result = { ok: false, found: false, slug: '' }
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify(result))
+      })
+      return
+    }
+
     // Set org endpoint
     if (req.method === 'POST' && req.url === '/api/set-org') {
       readBody(req, res).then((body) => {