#3015 extension push: --accept-warnings separate from --yes, and --json exits non-zero instead of skipping the warnings prompt

Problem

swamp extension push has two prompts on the way to a publish: "Continue with push despite warnings? [y/N]" and "Push @ to registry? [y/N]". One flag, --yes, answers both (src/cli/commands/extension_push.ts:552-566 and :635). CI therefore cannot confirm a push without also waiving every warning, including a real safety warning. In --json mode the warnings prompt is skipped silently and the push proceeds.

Across 42 dry-runs in the assessment every extension carried at least one warning (42/42 "no adversarial review recorded"), so in practice --yes is always waiving something, and nothing records that it did.

Expected

• --yes confirms the push. It does not waive warnings.
• A new --accept-warnings waives warnings. The push summary (log and JSON) records that warnings were accepted and lists them.
• A non-interactive run (--json, or no TTY) that hits a warning without --accept-warnings exits non-zero and names the flag it needs, instead of skipping the prompt.
• Interactive behaviour is unchanged: two prompts, two answers.

Acceptance

• push --dry-run --json on an extension with a warning and no --accept-warnings: non-zero exit, error names --accept-warnings.
• The same with --accept-warnings: exit 0, output carries the accepted warnings.
• push --yes on an extension with a warning, interactive: still prompts for the warnings.
• swamp-extensions .forgejo/workflows/publish.yml is updated to pass both flags where it passed --yes alone.

Out of scope

Per-rule suppression in the manifest and the channel-aware prompts (#2939) are separate issues in the same lane and build on this one.

Source: the extension push assessment (2026-10-02, swamp 20261002.194016) and the Extension Push UX Plan, which groups this with its lane and order.