refactor(extensions): simplify lib helpers, tool registration and kit-doctor

Behavior-preserving cleanups:
- extract shared resolveBaseUrl helper for jira/confluence base-URL logic
- extract shared registerTool helper; port jira/gitlab/confluence tools to it
- make scanSecrets declarative (filter/map)
- collapse ok/warn pair into status() and drop double existsSync in kit-doctor

Typecheck clean; npm test 71 PASS, 0 FAIL.

extensions/lib/tools.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared native pi tool registration.
+ * The three *-tools.ts extensions each register tools whose `execute` bodies
+ * are byte-identical apart from the error prefix in the failure payload.
+ * This helper DRYs that boilerplate; extensions only supply the spec.
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+export interface ToolSpec {
+	name: string;
+	description: string;
+	parameters: Record<string, unknown>;
+	/** Prefix in the error payload, e.g. "jira" → "jira error: …". */
+	errorPrefix: string;
+	run: (params: any) => Promise<unknown>;
+}
+
+/** Register a native tool whose result/error payload is formatted uniformly. */
+export function registerTool(pi: ExtensionAPI, spec: ToolSpec): void {
+	pi.registerTool({
+		name: spec.name,
+		label: spec.name,
+		description: spec.description,
+		parameters: spec.parameters as any,
+		async execute(_id: string, params: unknown) {
+			try {
+				const out = await spec.run(params ?? {});
+				return { content: [{ type: "text", text: JSON.stringify(out ?? {}, null, 2) }], details: {} };
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				return { content: [{ type: "text", text: `${spec.errorPrefix} error: ${msg}` }], isError: true, details: {} };
+			}
+		},
+	});
+}