Add designlang public-shell pack; tighten auth capture checks

Ran authenticated extract against coulomb.social; session metadata
matched anonymous Bubble defaults, so treat docs/design-extract as a
public shell baseline (PROVENANCE.md). Capture script now refuses to
overwrite storage-state.json with thin anonymous sessions.

scripts/run-design-extract.sh

@@ -30,10 +30,13 @@ echo "    auth:  $STATE_PATH (session file present; not printed)"
 echo "    out:   $OUT_DIR"
 echo "    extra: $*"
 
-# Default pack is useful for agent rebuild; caller can pass more flags.
+# Global flags (auth, name) must precede the subcommand; pack only accepts -o/--with-clone/--open.
 # --cookie-file accepts Playwright storageState JSON.
-exec npx --yes designlang pack "$URL" \
+# Extra args after -- are appended to pack (e.g. --with-clone).
+mkdir -p "$(dirname "$OUT_DIR")"
+exec npx --yes designlang \
   --cookie-file "$STATE_PATH" \
-  -o "$OUT_DIR" \
   --name coulomb-social \
+  pack "$URL" \
+  -o "$OUT_DIR" \
   "$@"