#3637 extension push: rewrite bare imports in the shipped source to their import-map specifiers

Push ships each extension's source with the author's bare imports as written, but not the deno.json that maps them, so the registry cannot resolve them: its dependency trust scan (text scan for npm: and jsr: specifiers) never sees those dependencies, deno doc fails and the extension publishes unscored, and pulled source does not resolve without the author's config.

Proposal: when staging the archive, push rewrites each bare import the source uses to the npm: or jsr: specifier the deno.json import map resolves it to, at the import's exact span, the same way it already rewrites relative imports so they resolve inside the archive (planSourceArchive and applySpecifierRewrites in src/domain/extensions/source_archive_plan.ts, swamp-club#3376). Resolution reuses the import-map resolver built for swamp-club#3611 (exact, trailing-slash and package-subpath keys). deno info already reports each bare import's span and resolved target, but the rewrite should resolve through the import map JSON so it does not add a deno CLI dependency.

Effects: the registry audits these dependencies with its existing scan and no swamp-club change; deno doc resolves the source so the extension is scorable; pulled source resolves without deno.json. The bare-specifiers review rule (it warns that the registry cannot score the extension) changes or retires, and swamp-uat expectations for it change.

Depends on swamp-club#3611. Coordinate with swamp-club#3613, which changes the module-graph reader. swamp-club#3629 covers versions already published.

Constraint from swamp-club#3613: once it lands, any deno invocation this work adds for push or quality must pass readOnlyLock (denoProjectArgs with readOnlyLock from readOnlyLockFor(project), or the module-graph reader constructed with readOnlyLock true), or it rewrites the author's deno.lock again.