#3611 extension push: dependencies named only through a deno.json import map are never audited

Extension push's dependency trust audit extracts npm: and jsr: specifiers from source text only (src/domain/extensions/extension_dependency_extractor.ts). An import written as a bare name that the extension's deno.json import map maps to npm: or jsr: is bundled, but it is never audited: no OSV query, no deprecation, license or loose-specifier check. The bare-specifiers review rule warns about the bare import, but only because the registry's scorer cannot resolve it, not because the dependency went unaudited.

Scale: the swamp-extensions corpus carries 1,352 import-map entries (1,345 exact, 7 ranges) across 703 deno.json files, none of them seen by the audit. Found during the swamp-club#3352 lockfile census.

Expected: the audit resolves bare imports through the same import map the bundler uses (readImportMap in src/libswamp/extensions/push.ts already reads it) and audits the mapped npm:/jsr: target at the version that ships.