#3793 extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited

Found while planning swamp-club#3662.

In package.json mode, extractSpecifiersFromSource and extractDependencySpecifiers (src/domain/extensions/extension_dependency_extractor.ts) dedupe dependency specifiers by registry, name and the range package.json declares, and ignore installedVersion. Push ships each bare import as npm:@ (swamp-club#3630). So when two importers resolve the same declared range to different installed copies, for example nested node_modules in a workspace, the archive ships two exact versions while the audit checks only one of them.

Expected: each installed version that ships is audited. The dedupe key should include installedVersion when it is set.

Impact is low. It needs two installed copies of one package under the same declared range, and the registry already audits the exact spec it sees in the shipped source.