It would certainly be nice to get something ala F-droid for free software extensions like yours (which guarantees source code matches built package IIRC), as a response to your question 3.
I am sure one can create an alternative extensions store in FF and change some config in about:config to use it, though it's likely non-trivial.
It would probably be more successful as a feature added to an existing trusted extension such as Temporary Containers.
Do you have a way to prevent terminal utilities from accessing the network?
$ bwrap --unshare-net --dev-bind / / bash
$ curl google.com
curl: (6) Could not resolve host: google.com
The only minor counter-argument would be laziness as a security threat: the more difficult you make the process, the more likely the user will skip seemingly useless steps, thus compromising security.
Some things I can do with regular POSIX and GNU tools directly from the CLI, so I'd trust those too on my Debian/Ubuntu systems (where there is usually a guarantee you can get the source code for the binary you are running). It's definitely possible Debian/Ubuntu experience a supply chain attack too, but it's significantly less likely than a random library from github IMO.