#333 doctor extensions invalidateAll does not trigger fingerprint recheck for existing Indexed rows

Steps to reproduce

1. swamp repo init
2. Write a valid model extension (e.g. copy ext/hello.ts fixture)
3. Run swamp doctor extensions --verbose — extension reaches Indexed
4. Replace the extension source with schema-invalid content (e.g. export const model = "not an object";)
5. Run swamp doctor extensions --verbose again

Expected

The fingerprint should change (file content changed), reconcile should re-bundle, and the row should transition to BundleBuildFailed since the content matches the exportRegex but fails validation.

Actual

The row stays Indexed with the original fingerprint. The on-disk sha256 differs from the stored fingerprint, but reconcile doesn't recompute it.

Analysis

doctor extensions calls rescanRepo.invalidateAll() which clears isPopulated flags. But the reconcile fingerprint comparison at reconcile_from_disk_service.ts:432 (if (fp === existingSource.fingerprint) continue;) appears to use a stale cached value rather than reading the file fresh. The file has actually changed (different sha256) but the stored fingerprint isn't updated, so the comparison short-circuits.

This means BundleBuildFailed is unreachable through the CLI for local extensions that were previously Indexed — the reconcile path never re-evaluates them even after invalidateAll().

Impact

Extension UAT suite cannot test BundleBuildFailed state transitions via CLI-observable commands. The state is only reachable through internal test harnesses that call the reconcile service directly.