Tests used setExtensionPaths but update() iterates packages, not extensions. All 5 non-pinned tests were silently passing as no-ops. Also add regression test for scope-aware update behavior.