Persistent extensions on by default, with a deliberate off switch

[pcarrier]

--allow-persistent-extensions becomes the default and the flag is removed. The
gate is now --no-persistent-extensions (or BLIT_ALLOW_EXT_PERSIST=0).

Why

An extension without persistence is half-installed: it runs, but its @name
command namespace never exists and nothing survives a restart. So the commonest
first experience of extensions was one that started and then did none of what
its README promised, with blit ext commands silently empty. A gate whose off
position quietly breaks the feature is one operators find by being confused.

Persistence is durability, not privilege — an endpoint that can install an
extension can already run an arbitrary command through CREATE2(HAS_COMMAND),
which is the argument docs/design/extensions.md
already makes. What the switch is genuinely good for is recovery: a
--restart always definition that sends C2S_QUIT would otherwise stop every
new server process. That stays, as an explicit off.

What changed

• --no-persistent-extensions refuses create/update/control and startup
  restore; BLIT_ALLOW_EXT_PERSIST is now read as =0 to disable, mirroring
  the BLIT_PROCESS=0 / --no-processes precedent next to it.
• --allow-persistent-extensions is deleted, not kept as a hidden no-op — it
  was never in a real release. clap answers it with
  tip: a similar argument exists: '--no-persistent-extensions'.
• NixOS blit.extensions.persistent defaults to true and passes the env var
  only to turn persistence off.
• The PERMISSION and BLOCKED details no longer name a flag that is now the
  default: "persistent extensions are disabled on this server".
• process-compose.yml and e2e/start-servers.sh drop the flag; the RFC,
  docs/systemd-user-units.md, docs/design/env.md, and both extension
  READMEs are updated.

Verified

Against a private server (short socket path, private XDG_STATE_HOME and
BLIT_EXTENSION_PATH):

• No flags at all: ext run --persist --restart always session session.wasm
  installs and ext list shows running.
• Restarting that same state with --no-persistent-extensions: ext list shows
  blocked, ext status details "persistent extensions are disabled on this
  server", and ext run --persist fails with
  permission denied: persistent extensions are disabled on this server.
• BLIT_ALLOW_EXT_PERSIST=0 disables it the same way.
• cargo test -p blit-server --lib extension (81 passed), clippy clean on
  blit-server/blit-cli --all-targets.

[indent]

PR Summary

Makes persistent Wasmi extensions permitted by default, so blit ext run --persist works (and the @name command namespace exists) without an opt-in flag. The old --allow-persistent-extensions gate is replaced by a deliberate off switch, --no-persistent-extensions (or BLIT_ALLOW_EXT_PERSIST=0), which is retained as the recovery path for a bad --restart always definition that would otherwise stop each new server.

• crates/cli: server now computes allow_persistent_extensions = !no_persistent_extensions && BLIT_ALLOW_EXT_PERSIST != "0", mirroring the adjacent --no-processes/BLIT_PROCESS=0 gate. --allow-persistent-extensions is deleted entirely (not kept as a hidden no-op), since it was never in a released version; clap now answers it with a "did you mean --no-persistent-extensions" tip.
• crates/server: PERMISSION/BLOCKED detail strings reworded to "persistent extensions are disabled on this server"; the Config doc comment updated. Gating behavior itself is unchanged.
• nix/nixos-module.nix: blit.extensions.persistent now defaults to true and passes BLIT_ALLOW_EXT_PERSIST=0 only to disable.
• process-compose.yml and e2e/start-servers.sh drop the flag (default-on covers them); the RFC, systemd/env docs, and both extension READMEs are updated.

Issues

Review closed.

_{View session}

[github-actions]

Coverage

Crate	Lines	Functions	Regions
alacritty-driver	75.7% (934/1234)	78.7% (74/94)	79.0% (1521/1926)
browser	0.0% (0/825)	0.0% (0/69)	0.0% (0/1404)
cli	39.9% (5920/14836)	46.5% (596/1282)	40.8% (9238/22637)
compositor	35.1% (6042/17209)	49.7% (501/1009)	34.9% (8305/23786)
desktop	78.5% (4298/5478)	71.3% (376/527)	74.9% (5943/7933)
fonts	85.3% (756/886)	89.9% (71/79)	86.4% (1485/1719)
fssync	92.5% (5513/5961)	94.4% (501/531)	92.7% (10179/10981)
gateway	34.0% (669/1966)	40.2% (68/169)	31.4% (1029/3279)
git	87.7% (4643/5295)	90.2% (378/419)	87.5% (7409/8463)
guest	82.8% (2286/2760)	80.4% (259/322)	81.5% (3813/4677)
lsp	77.2% (2688/3483)	79.4% (262/330)	74.9% (4210/5619)
proxy	19.2% (172/898)	20.5% (26/127)	21.0% (293/1392)
remote	91.7% (17409/18989)	94.5% (1223/1294)	89.3% (28254/31648)
sd-notify	72.8% (67/92)	100.0% (6/6)	82.4% (108/131)
server	56.6% (32418/57319)	63.7% (2785/4374)	57.8% (49099/84889)
ssh	32.2% (165/512)	48.2% (27/56)	31.4% (261/830)
upsidedown	31.4% (391/1247)	27.8% (55/198)	34.8% (797/2287)
webrtc-forwarder	8.5% (238/2805)	10.7% (22/205)	6.3% (289/4595)
webserver	64.4% (1250/1941)	67.6% (173/256)	66.6% (2099/3151)
Total	59.7% (85859/143736)	65.2% (7403/11347)	60.7% (134332/221347)