#3781 Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it

Problem

The rubric exists twice. In swamp it is src/domain/extensions/extension_rubric_scorer.ts, which describes itself as the client-side counterpart. In swamp-club it is lib/domain/scorecard/analysis-factors.ts and score.ts. Every rubric change (a new factor, new points, a RUBRIC_VERSION bump) has to be written twice and released in step. Until both sides ship, swamp extension quality predicts a different score than the registry shows. swamp-club#3757 is the latest example: it adds a factor that needs a matching swamp-club change.

Proposal

Move the pure parts into a public JSR package published from the swamp repo's packages/ directory, and have swamp-club import it. The pure parts are the factor table and points, composeScore, the factor computations over README text and doc output, and detectors such as the secret-docs check from #3757. The package stays public because the CLI is public, so swamp-club depends on swamp, not the other way round. swamp-club already does this with the swamp-lib client (imported as @swamp/client).

Each side keeps its own I/O: running deno doc, unpacking the archive, the server's HTTP check for repository-verified, and private-source standing.

Outcome

A rubric change becomes one change in swamp plus a version bump in swamp-club. A shared test fixture set could then show both sides score the same archive identically.

Out of scope

The #3757 factor itself; that issue mirrors it by hand one last time.