#3703 Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

Problem

On a shared Swamp serve, named developers should be able to read resources, run selected CI workflows, and install approved collective extensions followed by a reload. Only designated operators should remain administrators.

Verified against Swamp 20261021.050521.0-sha.bfde0792, src/serve/handlers/admin_handlers.ts:

• handleExtensionPull authorizes admin on model:* before parsing the extension reference. There is no package/namespace-scoped pull permission.
• handleServeReload authorizes admin on access:*. That grant is superuser access, so delegating reload also delegates unrelated administration.

Current workaround: keep extension pulls and reload admin-only. Do not grant developers superuser access just to enable this flow.

Requested behavior

Provide independently grantable permissions for remote extension installation and extension reload, without requiring admin on model:* or access:*.

• Allow explicit users to pull a particular extension or an approved namespace such as @swamp/*.
• Authorize the normalized package identity, including version/channel resolution, before installing or changing state.
• Define and enforce transitive dependency handling: out-of-scope dependencies must not silently bypass the restriction. Support an explicit dependency policy or refuse with actionable diagnostics before mutation.
• Delegate extension reload independently of grant/token management and other server administration. Define whether this is a narrower extension-only reload or how other reload effects are authorized.
• Preserve registry membership/private-package checks; server authorization must not implicitly grant registry access.
• Expose decisions through access check/can-i, CLI and dashboard, with useful refusal messages.
• Audit principal, requested/resolved package version, install outcome, and reload outcome.

Acceptance criteria

A non-admin explicitly granted approved-package pulls and reload can perform that flow, while being denied unrelated package installation, grant changes, token administration, and unrelated admin operations. Pull-only and reload-only grants are independently enforceable. Existing admins retain access. Cover dependency escapes, denied/no-side-effect cases, revocation, and allowed cases with integration tests; document the new grants and the trust implications of installing executable extension code.

Ownership: core Swamp serve authorization, not a third-party extension.