fix(skills): extension id rules match Blender's validator; permissions are not a sandbox

- bl-info-migration said `id` may be "reverse-DNS or short slug" and
  addon-scaffolding gave the regex [A-Za-z_][A-Za-z0-9_]*. Blender's
  pkg_idname_is_valid_or_error (bundled blender_ext.py, identical in 4.5.11 and
  5.2.1) requires str.isidentifier() and rejects "__", a leading "_" and a
  trailing "_". Both skills now state that rule with pass/fail examples.
- addon-scaffolding claimed an extension without `permissions` "is sandboxed
  against network, files, clipboard, and camera"; the rule said bl_info-only
  add-ons "are sandboxed by default". Permissions are declarations shown to
  users; Blender does not restrict add-on Python. Text now says so, lists all
  five valid keys (files, network, clipboard, camera, microphone), and points
  at bpy.app.online_access for network code.

Proof (local, .scratch/blender-5.2.1-windows-x64, `blender --command extension
validate` on a copy of templates/extension-addon-template with the id swapped):
my_tool -> exit 0; com.acme.tool, _tool, my__tool -> exit 1.
bpy.app.online_access exists (False under --factory-startup).

Closes #328

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: TMHSDigital

rules/target-extensions-platform-format.mdc

@@ -19,8 +19,10 @@ compatibility, but new code should treat the manifest as the source of
 truth. Add-ons that ship only `bl_info`:
 
 - Cannot be submitted to the official extensions platform.
-- Cannot declare `permissions` (network, files, clipboard, camera) and
-  therefore are sandboxed by default with no way to request access.
+- Cannot declare `permissions` (files, network, clipboard, camera,
+  microphone). Permissions are declarations shown to users, not a sandbox:
+  Blender does not restrict add-on Python either way, so a `bl_info`-only
+  add-on simply cannot tell users what it accesses.
 - Cannot declare `tags` for discovery.
 - Lose access to manifest-only fields like `tagline`, `website`,
   `copyright`, structured `license`.

skills/addon-scaffolding/SKILL.md

@@ -47,7 +47,7 @@ copyright = ["2026 TMHSDigital"]
 Field rules that AIs commonly get wrong:
 
 - `tagline` is hard-capped at 64 characters and **must not end with a period**. Blender's manifest validator rejects both.
-- `id` must be a valid Python identifier (`[A-Za-z_][A-Za-z0-9_]*`). The directory name does not need to match the `id` but conventionally does.
+- `id` must be a valid Python identifier with no double underscore and no leading or trailing underscore: `my_tool` passes; `com.acme.tool`, `_tool`, `tool_` and `my__tool` fail `blender --command extension validate` (`pkg_idname_is_valid_or_error` in the bundled `blender_ext.py`, same rules on 4.5 and 5.2). The directory name does not need to match the `id` but conventionally does.
 - `license` and `copyright` are **arrays of strings**, not bare strings.
 - `blender_version_min` is the floor. Setting it to `"4.5.0"` lets the same code run on 4.5 LTS and any 5.x. Setting it to `"5.0.0"` cuts off LTS users with no warning.
 - `schema_version` is `"1.0.0"` for the current manifest schema. Do not bump it.
@@ -60,7 +60,7 @@ tags = ["Mesh", "Geometry Nodes"]
 permissions = { network = "Optional, only used to fetch updates" }
 ```
 
-`tags` must come from Blender's known tag list. `permissions` is a dict of granted-permission to human-readable reason; if omitted, the extension is sandboxed against network, files, clipboard, and camera.
+`tags` must come from Blender's known tag list. `permissions` maps each capability the add-on uses to a human-readable reason; the valid keys are `files`, `network`, `clipboard`, `camera` and `microphone`. It is a **declaration** shown to users and reviewers on the extensions platform, not a sandbox: Blender does not restrict what add-on Python can do, with or without it. Declare everything the code actually uses. For network access, also honor `bpy.app.online_access` (the user's "Allow Online Access" preference) and do nothing online when it is `False`.
 
 ## File layout
 

skills/bl-info-migration/SKILL.md

@@ -43,7 +43,7 @@ Create a new file `blender_manifest.toml` next to `__init__.py`. Translate the `
 | `"description"` | `tagline = "..."` | Renamed |
 | `"category"` | `tags = ["..."]` | Now a list of allowed tags |
 | `"location"`, `"warning"` | (no equivalent) | Drop |
-| (none) | `id = "..."` | New required field; reverse-DNS or short slug |
+| (none) | `id = "..."` | New required field; a Python identifier such as `my_tool` (no dots, so not reverse-DNS; no `__`; no leading or trailing `_`) |
 | (none) | `schema_version = "1.0.0"` | Required |
 | (none) | `type = "add-on"` | Required |
 | (none) | `license = ["SPDX:..."]` | Required SPDX expression |