#3676 extension push: a deno.json scopes entry can make push ship and audit a different version than the extension resolves

swamp-club#3637 makes push rewrite each bare import to the target the deno.json imports map resolves it to, and the dependency audit resolves the same way (resolveBareImport over readImportMap, which reads only the top-level imports object). Deno also honours a scopes entry that remaps a name for a directory. When the top-level imports map "ms" to npm:ms@2.1.3 and a scope covering extensions/ maps it to npm:ms@3.0.0, the author bundles and tests against 3.0.0, but the archive's source ships npm:ms@2.1.3, which is also the version push audits, with no warning.

Expected: push never ships a different version than the one the extension resolves. Either resolve through the scope that covers the importing module (as Deno does), or treat a name any scope remaps as unresolved, so it ships as written and the bare-specifiers finding names it.

Found by the swamp-club#3637 adversarial review (verify-reviews on 52026da1). The design doc's Bare imports in the shipped source section notes that scopes is not read.