#3406 CLI companion to #3396: private-source collectives can score repository-verified 14/14 in extension quality

Follow-up to #3396. The registry now awards repository-verified to extensions owned by a collective with private source hosting when repository is an https URL the verifier cannot confirm as public (self-hosted GitLab, Gitea, Forgejo, GitHub Enterprise, private repos). The CLI's local rubric (src/domain/extensions/extension_rubric_scorer.ts repositoryVerifiedRow) still marks any repository off the four public forges as missing with the remediation 'Set repository: to a public HTTPS URL on github.com, gitlab.com, codeberg.org, or bitbucket.org', so 'swamp extension quality' and 'swamp extension push --dry-run' fail a 14/14 CI gate for exactly the collectives the registry now credits. Proposed: treat any well-formed https repository URL as provisional (server decides on publish), keep missing for absent, non-https or malformed URLs, and reword the remediation to mention private source hosting. Docs: content/manual/reference/extensions/publishing.md already describes the provisional/missing split.