#3114 swamp-extensions: replace bare import specifiers with npm:/jsr: specifiers in first-party extensions

Problem

First-party extensions in swamp-extensions import bare import-map names that the registry's server-side scorer cannot resolve, so they publish unscored. Found during swamp-club#3022, which makes bare-specifiers a non-acceptable finding in both swamp extension quality and swamp extension push and will turn it into a push error in a later release.

Known instances (grep for imports of bare names such as zod, @std/path, @azure/core-auth):

• vault/azure-kv (@azure/core-auth)
• issue-lifecycle/extensions/models (zod, @std/path)
• extensions/models (review_record.ts, _lib/swamp_club.ts)
• codegen pipelines and the extensions they generate (aws, cloudflare, hetzner, tailscale, digitalocean, scripts/generate-aws-credentials.ts) — the generator templates should emit explicit specifiers so generated extensions follow best practice.

Expected

Every import in a published extension uses an explicit npm:, jsr: or relative specifier, taken from the extension's deno.json import map. swamp extension quality reports no bare-specifiers finding for any extension in the repo, and the codegen templates emit explicit specifiers.

Acceptance

• swamp extension quality on every extension in swamp-extensions shows no bare-specifiers finding.
• Regenerating a codegen extension produces no bare specifiers.