Review guidelines

Coming in a later phase. Kits listed in the Kit directory will be reviewed before listing: least-privilege scopes, a privacy policy, verified domains for every manifest URL, a security questionnaire and a functional test. Private Kits are not reviewed; they stay inside the workspace that created them.