#2531 managedConfig: the datastore extension is only found through a lockfile, so the config base is guessed (part 3c of swamp-club#2483)

Part 3c of swamp-club#2483 (split from part 3 for review).

In a managedConfig repo on an extension-backed datastore (S3, GCS), the datastore extension must load before the managed config base, and so the lockfile, can be found. The datastore loader reads the extension from a lockfile, so it can miss the extension, for example right after datastore config migrate, and resolution then guesses the base.

Fix:

• The datastore loader finds datastore extensions on disk under both in-repo pulled roots. It matches by manifest name, dedupes with the managed root preferred, skips unreadable directories, and reads no lockfile.
• Catalog rows for a copy that lost the dedupe are purged.
• Reconcile (startup, doctor extensions and serve) walks and exempts those sources the same way.
• The auto-resolve hot-load includes them.

Depends on 3b (swamp-club#2530).