Add opt-in, versioned extension manifest for user-declared verified tool locations

[ekalb81]

Problem

The built-in candidate list in Get-VerifiedDirectoryCandidates is intentionally small. Advanced users have no supported way to declare additional tool directories without editing the script.

Proposed fix (from project backlog, P2)

• Define a documented, versioned local manifest format that declares additional executable-parent directories, validation rules, and target scope (Machine/User).
• Require an explicit opt-in parameter (e.g. -ExtensionManifest <path>) before reading it.
• Show every manifest-derived candidate in the preview, subject to the same existence verification as built-in candidates.
• Never recursively scan arbitrary directories.
• Must not weaken the default preview-and-approve workflow.

Acceptance criteria

• Manifest schema documented in README with a version field and rejection of unknown versions.
• Tests covering manifest parsing, rejection of invalid manifests, and candidate verification.