Datastore auto-update in resolve_datastore.ts uses force:true, risking silent overwrite of local edits

Problem

src/cli/resolve_datastore.ts:132 calls installExtension with force: true inside the pullExtension callback of maybeAutoUpdateDatastoreExtension. When the registry has a newer version of a datastore extension than the user has on disk, auto-update fires and silently overwrites the pulled directory — including any local edits the user made — without a prompt or warning.

Same data-loss family as swamp-club#121 (auto-resolver force-pull), but a different trigger (version-behind rather than type-not-found) and a different fix shape: auto-update by definition wants to replace the prior install, so isInstalled skip-and-surface (the #121 fix) doesn't apply here. Need per-file change detection (e.g. a content hash of the extracted files at install time, compared on each auto-update attempt) to distinguish "clean install, safe to overwrite" from "user has local edits, refuse to clobber".

Scope of affected code

• src/cli/resolve_datastore.ts:132 — force: true in pullExtension callback
• src/libswamp/extensions/pull.ts — would need to record a per-file manifest anchor at install time (the existing SHA-256 is over the archive tarball, insufficient for detecting extracted-file modifications)

Suggested fix direction

At install time, compute and store a per-file content anchor in upstream_extensions.json alongside the existing archive checksum. On auto-update, before overwriting, recompute the anchor from current on-disk files; if it differs from the stored value, surface a "local edits detected" error with swamp extension pull <name> --force as the opt-in command, matching the pattern swamp-club#121 established for auto-resolve.

Context

Discovered during swamp-club#121 investigation. Explicitly out of scope of #121's fix so that data-loss fix could ship with tight scope. Tracking separately here.