Add authenticated designlang extract path for coulomb.social

Interactive Playwright session capture (XDG storageState, mode 0600)
plus a designlang pack wrapper that never prints secrets. Document the
intended OpenBao lane tenants/binky/coulomb-social/bubble-member for
later password custody; interactive capture is the default for Bubble.

scripts/run-design-extract.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Run designlang against coulomb.social using a captured Playwright storageState.
+# Does not print secrets. Requires: ./scripts/capture-auth-state.mjs first.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+AUTH_DIR="${COULOMB_SOCIAL_AUTH_DIR:-$HOME/.config/coulomb-social/auth}"
+STATE_PATH="${COULOMB_SOCIAL_STORAGE_STATE:-$AUTH_DIR/storage-state.json}"
+OUT_DIR="${COULOMB_SOCIAL_EXTRACT_OUT:-$ROOT/docs/design-extract}"
+URL="${COULOMB_SOCIAL_URL:-https://coulomb.social}"
+
+if [[ ! -f "$STATE_PATH" ]]; then
+  echo "ERROR: No auth session at $STATE_PATH" >&2
+  echo "Capture one first (interactive login as your user):" >&2
+  echo "  $ROOT/scripts/capture-auth-state.sh" >&2
+  echo "Docs: $ROOT/docs/design-extract-auth.md" >&2
+  exit 1
+fi
+
+mode="$(stat -c '%a' "$STATE_PATH" 2>/dev/null || stat -f '%Lp' "$STATE_PATH" 2>/dev/null || echo '?')"
+if [[ "$mode" != "600" && "$mode" != "0600" ]]; then
+  echo "warning: $STATE_PATH mode is $mode (prefer 600)" >&2
+fi
+
+mkdir -p "$OUT_DIR"
+
+echo "==> designlang extract"
+echo "    url:   $URL"
+echo "    auth:  $STATE_PATH (session file present; not printed)"
+echo "    out:   $OUT_DIR"
+echo "    extra: $*"
+
+# Default pack is useful for agent rebuild; caller can pass more flags.
+# --cookie-file accepts Playwright storageState JSON.
+exec npx --yes designlang pack "$URL" \
+  --cookie-file "$STATE_PATH" \
+  -o "$OUT_DIR" \
+  --name coulomb-social \
+  "$@"