#3613 extension push rewrites the author's deno.lock when bundling

Push bundles with --config <deno.json> (src/domain/models/bundle.ts denoProjectArgs) and never passes --frozen. When the extension's deno.lock no longer satisfies a specifier, Deno silently re-resolves it and rewrites the lock in place, so a push or a quality run mutates a file in the author's working tree. package.json mode creates or updates a deno.lock beside the package.json the same way. Seen with deno 2.9.7 during the swamp-club#3352 lockfile census: a lock pinning npm:ms@^2.0.0 at 2.0.0 was rewritten when the specifier moved past it.

Expected: push treats the author's lockfile as read-only, either by bundling with --frozen and reporting a stale lock, or by bundling against a copy.