Why

Today, the prepare menu sends the user's IMS token to every extension iframe. This change lets a prepare sheet row opt in to SDK2. An SDK2 extension gets no token. It gets a daFetch that the host runs for it. Refs #1408.

What changed

• A new optional sdk column in the prepare sheet. An empty cell or 1 keeps the current behavior. 2 connects the iframe to the da-nx extension host (connectExtension). The menu hides a row with any other value, so a typo never sends the token.
• For SDK2 rows, the menu connects when the iframe renders, and closes the connection when the dialog closes, the details change, or the menu disconnects.
• The legacy 750 ms token timer checks the iframe again before it sends. Lit can reuse the same iframe for an SDK2 row, and that row must not get the token.

Scope

• Depends on feat(sdk): add SDK2 with a host-proxied daFetch da-nx#864, which adds nx2/utils/extension-host.js and the SDK.
• Only the prepare menu. Panel extensions keep the token for now.
• The sheet merge replaces whole rows. A site row that overrides an org row must repeat sdk = 2.

Blast Radius

Rows without the sdk column work as before, and the existing tests for them still pass. The SDK2 path runs only for rows with sdk = 2.

Verification

• npm test: 2501 passed, 0 failed. New tests cover the sdk column parser, SDK2 connect and close, hidden invalid rows, and the reused-iframe race.
• Manual test on localhost with ?nx=local and a test extension in bpauli/frescopa. "Add to snapshot" added the page to a snapshot (HTTP 200) through the host. The extension frame got no token, and requests to another site were denied.