docs: clarify that no extensions are installed by default

Two-line addition to docs/extensions.md and a tightening of the
README bullet point. examples/extensions/* are reference code; a
fresh `zot install` gives you a clean agent. Users opt in by
copying examples (or any other extension) via `zot ext install`
or by pointing `zot --ext PATH` at a working directory for one
session.

No code changes.

README.md

@@ -7,7 +7,7 @@ yet another coding agent harness, lightweight and written (vibe-slopped) in go.
 - four tools (read, write, edit, bash).
 - three run modes (interactive tui, print, json).
 - built-in telegram bot.
-- extensions in any language via subprocess + json-rpc; see [docs/extensions.md](docs/extensions.md).
+- extensions in any language via subprocess + json-rpc — none installed by default; opt in with `zot ext install` or `zot --ext`. see [docs/extensions.md](docs/extensions.md).
 - reusable instructions via `SKILL.md` files; see [docs/skills.md](docs/skills.md).
 - no community atm.
 

docs/extensions.md

@@ -61,6 +61,25 @@ zot ext install ./hello-py
 
 Restart `zot`, type `/hellopy`, the agent greets you. Done.
 
+## Built-in extensions
+
+**zot ships with no extensions installed by default.** A fresh `zot install` (or `go install`) gives you a clean agent. Extensions are entirely opt-in: you install (or `--ext` for one run) only the ones you want.
+
+The `examples/extensions/` directory in the repo is reference code, not a default install set. To use any of those:
+
+```bash
+# go-based examples need a build first
+cd path/to/zot/examples/extensions/hello && go build -o hello .
+
+# install (copies to $ZOT_HOME/extensions/hello/)
+zot ext install path/to/zot/examples/extensions/hello
+
+# or load straight from the repo for one zot session
+zot --ext path/to/zot/examples/extensions/hello
+```
+
+Nothing is auto-installed and nothing reaches out to the network without your explicit action.
+
 ## Layout & discovery
 
 zot scans two directories on startup, in this order: