mkFirefoxModule: assert managed package for global extensions

Reject globalExtensions when Home Manager has no browser-managed policy
carrier. This follows up the global extension policy work with a clear
failure mode, a regression test, and a news entry so affected users know
how to fix package = null setups.

modules/misc/news/2026/06/2026-06-18_12-40-40.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, ... }:
+let
+  requiresManagedBrowserPackage =
+    browserCfg:
+    browserCfg.globalExtensions != [ ]
+    && browserCfg.package == null
+    && (!pkgs.stdenv.hostPlatform.isDarwin || browserCfg.darwinDefaultsId == null);
+in
+{
+  time = "2026-06-18T17:40:40+00:00";
+  condition =
+    requiresManagedBrowserPackage config.programs.firefox
+    || requiresManagedBrowserPackage config.programs.floorp
+    || requiresManagedBrowserPackage config.programs.librewolf;
+  message = ''
+    The `programs.firefox.globalExtensions`,
+    `programs.floorp.globalExtensions`, and
+    `programs.librewolf.globalExtensions` options now assert that the browser
+    package is managed by Home Manager. On Darwin, setting
+    `programs.<browser>.darwinDefaultsId` also satisfies this requirement.
+
+    If you used `globalExtensions` with `package = null`, set `package` to a
+    non-null browser package or switch back to
+    `profiles.<name>.extensions.packages`.
+  '';
+}

modules/programs/firefox/mkFirefoxModule.nix

@@ -1064,6 +1064,15 @@ in
           '';
         }
 
+        {
+          assertion =
+            cfg.globalExtensions == [ ] || cfg.package != null || (isDarwin && cfg.darwinDefaultsId != null);
+          message =
+            "'${moduleName}.globalExtensions' requires '${moduleName}.package'"
+            + " to be set to a non-null value unless"
+            + " '${moduleName}.darwinDefaultsId' is set on Darwin.";
+        }
+
         {
           assertion = builtins.all (
             elem:

tests/modules/programs/firefox/global-extensions-assertions.nix

@@ -1,5 +1,10 @@
 modulePath:
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   firefoxMockOverlay = import ./setup-firefox-mock-overlay.nix modulePath;
@@ -14,12 +19,17 @@ in
   config = lib.mkIf config.test.enableBig (
     lib.setAttrByPath modulePath {
       enable = true;
+      package = lib.mkIf pkgs.stdenv.hostPlatform.isLinux null;
       globalExtensions = [ extensionWithoutAddonId ];
     }
     // {
-      test.asserts.assertions.expected = [
-        "${lib.showOption modulePath}.globalExtensions requires each package to expose addonId in passthru."
-      ];
+      test.asserts.assertions.expected =
+        lib.optionals pkgs.stdenv.hostPlatform.isLinux [
+          "'${lib.showOption modulePath}.globalExtensions' requires '${lib.showOption modulePath}.package' to be set to a non-null value unless '${lib.showOption modulePath}.darwinDefaultsId' is set on Darwin."
+        ]
+        ++ [
+          "${lib.showOption modulePath}.globalExtensions requires each package to expose addonId in passthru."
+        ];
     }
   );
 }