#3466 Docs: private extension entitlement messages and whoami --json privateExtensions (follows swamp-club#3311)

What changed

swamp-club#3311 makes swamp extension push --private decide private entitlement from the registry's own verdict (privateExtensions on each whoami collectiveEntitlements entry: allowed, trial-ended, paywalled) instead of plan and trial, and rewords every entitlement message so the CLI never says Free plan. It also passes privateExtensions through swamp auth whoami --json.

Pages to update

1. content/manual/reference/extensions/publishing.md, Private entitlement section: the table of what the registry reported and the messages, plus the example error line. New rows: paid plan (is on the Team plan, which allows private extensions); active trial (is in its free trial (N days left, ends DATE), which allows private extensions); covered personal namespace (is your personal namespace, covered by a paid plan or active trial on another collective you belong to); trial ended (30-day free trial has ended. Private extensions need a paid plan; upgrade at BILLING); paywalled with a Personal License (has a Personal License, which does not include private extensions ...); paywalled otherwise (Private extensions in @slug need a paid plan; upgrade at BILLING); unknown verdict (not-run, decided at publish); admin standing. Also the refusal-at-upload sentences (At sign-in the registry reported that ...).
2. content/manual/how-to/extensions/create-and-publish.md line ~501: the example error still reads is on the Free plan and its trial ended on DATE.
3. content/manual/reference/api-key-authentication.md, whoami section: document the privateExtensions field in collectiveEntitlements of --json output, and that a personal namespace covered by another collective shows allowed.

Exact final wording is in the swamp PR for #3311 (extension_publish_checks.ts); update the manual once it ships.