#3612 extension push resolves the Deno config and import map the way Deno does: deno.jsonc, importMap file references and scopes

Merged 2026-10-20 (Seth): this issue now covers swamp-club#3676 and the deno.json-mode case of swamp-club#3669. All three have one root cause: push reads the Deno config and import map less completely than Deno does. Push's resolver (readImportMap / resolveBareImport), used by the bundle, by #3637's bare-import rewrite and by the dependency audit, reads only the top-level imports object of a file named deno.json. Deno also reads deno.jsonc, an importMap file reference, and scopes. When the two disagree, push either ships and audits a different version than the one the author built and tested against, or ships a bare import that later fails.

Cases

1. deno.jsonc is ignored (original #3612). findDenoConfig (src/cli/resolve_extension_files.ts:414) walks up from the manifest looking only for deno.json. A deno.jsonc project is bundled with --no-lock and no import map (bundle.ts denoProjectArgs). Yet src/domain/extensions/archive_root_sources.ts already names deno.jsonc in its archive refusal list. No current extension uses deno.jsonc, so this one is latent.
2. scopes is ignored (was #3676; correctness). Say the top-level imports maps ms to npm:ms@2.1.3, and a scope covering extensions/ maps it to npm:ms@3.0.0. Deno bundles and tests against 3.0.0, but the archive source ships npm:ms@2.1.3, and push audits that version, with no warning. Found by the #3637 adversarial review (verify-reviews on 52026da1).
3. An importMap file reference is ignored (deno.json case of #3669). Deno resolves the bare import through the referenced map, but push's resolver doesn't see it, so the import ships bare. extension quality's local scorer then crashes with deno doc --json failed ... Failed resolving '<name>' (expected from the code; not yet reproduced).

Expected

Push never ships or audits a different version than the one the extension resolves. Resolve the config as Deno does:

• deno.json, then deno.jsonc
• importMap file references
• the scope covering the importing module

Where push can't follow Deno exactly, treat the name as unresolved: it ships as written and the bare-specifiers finding names it. It must never resolve silently to a different target.

Acceptance

• Unit tests for each case.
• A UAT item, at least for the scopes case, extending the #3637 bare-import UAT.
• The package.json-mode crash in #3669 isn't covered here; it stays in #3669 with #3630/#3632.