#3664 Docs: bare imports mapped by deno.json are rewritten on push and scored

swamp-club#3637 changes extension push: each bare import the source uses that the project deno.json import map resolves to an npm:, jsr:, node: or http(s) specifier is rewritten to that specifier, as the map writes it, in the shipped archive source. The registry scorer and dependency audit therefore resolve and audit those imports, and the extension is scored. Only bare imports with no import-map entry (or any bare import in package.json mode, or one reached only through an importMap file reference or scopes) ship as written and still raise the bare-specifiers finding; quality exits non-zero and reports registryScorable false only for those.

Pages to update in content/manual/reference/extensions/:

• manifest.md: the Scoring limitation callout says bare specifiers cannot resolve at score time and the extension publishes unscored.
• publishing.md: the quality section and the Output (bare specifiers) example say any bare specifier leaves the extension unscored and quality exits non-zero.
• scorecard-rubric.md: names a bare specifier such as zod as an import that does not resolve; it now resolves when the map has an entry for it.

Also note that no deno.json or deno.lock ships in the archive, and that zod mapped to any 4.x range (for example npm:zod@^4) is still shared with the host.

Land after swamp-club#3637 ships.