extensions: add Notion integration for read-only workspace access

Add notion.ts extension providing read-only access to Notion workspaces via
the Notion REST API. Enables agents to search for pages/databases, retrieve
full page content with nested blocks, query database entries with filters,
and inspect database schemas.

Features:
- Search: Find pages and databases by text query or type filter
- Get: Retrieve complete page content formatted as markdown, including
  paragraphs, headings, lists, code blocks, callouts, and nested content
  (up to 1 level deep)
- List: Query database entries with JSON filters and sorting
- Database: Inspect schema and property types

Configuration:
- NOTION_API_KEY (internal integration token) in ~/.config/.env
- Pages/databases must be explicitly shared with the integration
- Read-only access (no write, update, or delete capabilities)

Documentation:
- Updated .env.schema with NOTION_API_KEY configuration
- Updated CONFIGURATION.md with setup instructions and capabilities
- Added comprehensive docs/notion-integration.md covering setup,
  usage examples, use cases, limitations, security, and troubleshooting

Use cases:
- Documentation lookup during task execution
- Specification and ADR retrieval for dev-agents
- Project database queries for task context

The integration follows the same pattern as existing extensions (linear.ts,
sentry-monitor.ts) and includes proper error handling, type safety, and
security considerations (token stored in 600-perms env file, read-only
access enforced by API capabilities).

Tested with TypeScript compilation (no errors) and biome linting (clean).

Author: baudbot-agent

.env.schema

@@ -182,6 +182,13 @@ SLACK_BROKER_DEDUPE_TTL_MS=1200000
 # @docs(https://linear.app/settings/api)
 LINEAR_API_KEY=
 
+# ── Notion (optional) ────────────────────────────────────────────────────────
+
+# Notion integration secret (internal integration token)
+# @type=string
+# @docs(https://www.notion.so/my-integrations)
+NOTION_API_KEY=
+
 # ── Tool Guard ───────────────────────────────────────────────────────────────
 
 # Unix username of the agent

CONFIGURATION.md

@@ -84,6 +84,23 @@ The `linear` extension provides a tool for interacting with the Linear issue tra
 |----------|-------------|---------------|
 | `LINEAR_API_KEY` | Linear API key (personal or OAuth token) | Go to [Linear Settings → API](https://linear.app/settings/api), create a **Personal API key**. For workspace-wide access, create an OAuth application instead. The key needs read/write access to issues and comments. |
 
+### Notion Integration
+
+The `notion` extension provides a read-only tool for accessing your Notion workspace. The agent can search for pages and databases, retrieve full page content (including nested blocks), query database entries, and inspect database schemas.
+
+| Variable | Description | How to get it |
+|----------|-------------|---------------|
+| `NOTION_API_KEY` | Notion integration secret (internal integration token) | Go to [Notion → My integrations](https://www.notion.so/my-integrations), create a new **Internal Integration**. Copy the **Internal Integration Token** (starts with `secret_`). After creating the integration, share the pages/databases you want the agent to access by clicking **"•••"** → **Add connections** → select your integration. The integration can only read content explicitly shared with it. |
+
+**Capabilities:**
+- `search` — Find pages and databases by text query or type filter
+- `get` — Read full page content with all blocks (paragraphs, headings, lists, code, callouts, etc.)
+- `list` — Query database entries with filters and sorting
+- `database` — Inspect database schema and property types
+
+**Permissions:**  
+The integration token only provides read access to pages/databases explicitly shared with the integration. It cannot create, update, or delete content.
+
 ### Slack Channels
 
 | Variable | Description | How to get it |