#3311 extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

Problem

swamp extension push --private decides private entitlement locally and refuses in enforce mode before the registry is asked. evaluatePrivateEntitlement (src/domain/extensions/extension_publish_checks.ts) reads whoami's per-collective plan/trial, and src/libswamp/extensions/push.ts throws validationFailed on a failed verdict.

Swamp Club is widening the rule in #1728: a personal namespace is entitled when any collective its owner belongs to is entitled (paid, or an active trial). The rule also folds in #2606: a former customer no longer falls back to its trial. A covered personal collective still reports plan: "free" with an expired (often superseded) trial, so the CLI refuses a push the registry would accept.

Change

whoami's collectiveEntitlements[] gains an additive field carrying the registry's own verdict:

privateExtensions: "allowed" | "trial-ended" | "paywalled"

It is present on both the session and the collective-token whoami. In evaluatePrivateEntitlement:

• allowed → passed
• trial-ended → failed with today's "trial ended" wording
• paywalled → failed with the "no trial" / paid-plan wording, without claiming a trial ended
• absent (older or self-hosted registry) → today's plan/trial logic, unchanged

explainPrivatePublishRefusal should follow the same field when present.

Repro (after #1728 ships)

1. Join a collective on a paid Team plan. Your personal trial is superseded, or has expired.
2. swamp extension push --private an extension in your personal namespace (@<username>/...).
3. The CLI fails locally with "...is on the Free plan and its trial ended..." although the registry allows it (the web toggle and POST /api/v1/extensions/<name>/private succeed).

Server side: swamp-club#1728.