#3169 extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

analyzeExtensionSafety (src/domain/extensions/extension_safety_analyzer.ts) warns when an extension spawns a subprocess with Deno.Command (rule deno-command; swamp-club #2965 moves it to the Babel AST from #2949). Other runtime routes to a subprocess get no warning on push or pull: an import of node:child_process or bare child_process (spawn, spawnSync, exec, execSync, execFile, execFileSync, fork), by static import, dynamic import(), require or createRequire; and node:cluster (cluster.fork). Proposed: flag the module import itself, since a namespace import reaches every function, under a new site-scoped, acceptable rule id rather than renaming deno-command, because renaming would turn existing inline deno-command acceptances into blocking invalid-acceptance findings. Out of scope: npm and jsr wrappers (execa, cross-spawn, zx, dax, shelljs, node-pty), since the analyzer never scans dependencies and any package can spawn internally - document that instead of keeping a deny-list. Deno.run is gone in Deno 2. A read-only scan of swamp-extensions main (0f757c5b9) found no use of child_process, cluster or any wrapper outside tests, so the warning adds no findings there. Raised while planning swamp-club #2965.