#3969 Extension dependencies: one resolver for push, quality and fmt (no behaviour change)

Repo: swamp. Step 1 of the extension dependency-forms design. Design: Extension dependency forms Doc, https://claude.ai/artifact/WpRbpqb5djPgDXzydFSohs (decided 2026-10-26).

Problem

Swamp re-derives Deno's dependency answer in about nine places: separate regex and token scanners for import sites, two deno info reads, and its own import-map resolver. push, quality and fmt each read the project slightly differently. Most of the last month's dependency bugs (#3612, #3676, #3637, #3669, #3630, #3793, #3613, #3717) sit in those gaps. Only Deno decides how importMap, scopes, workspaces and config discovery behave, and no test pins it.

Proposal (no behaviour change)

• A new src/domain/extensions/dependency_resolution/ module that push, quality and fmt all call. Nothing else parses a specifier or an import map.
• detectExtensionProject (mode, config path, lock path, package dir, and whether Deno would discover a config above the boundary). It replaces findDenoConfig, findPackageJsonDir, sourceHasBareSpecifiers, lockfilePathFor, readOnlyLockFor and the package.json trigger.
• One Babel import-site scan, replacing STATIC_IMPORT_RE, DYNAMIC_IMPORT_RE, IMPORT_SPECIFIER_RE, IMPORTED_SPECIFIER_RE, the token scanner and importSourceOffsets.
• A DenoModuleGraph port with one deno info --json adapter, using the bundle's own flags. It keeps redirects and npmPackages (exact versions Deno already returns, which swamp ignores today).
• A swamp-only dependency_input_vectors/ set of directory fixtures, one per input category in the Doc's 3.3 table, run against real Deno. They pin today's behaviour, including #3793's per-copy audit and today's workspace and ancestor-config outcomes, before anything moves.

Acceptance

• Every existing push, quality and fmt test passes unchanged.
• The input vectors pass, and a Deno upgrade that changes resolution fails a named vector.
• UAT: none new. Run swamp-uat's existing push, quality, fmt and registry/pull_dependency_record suites against the build and diff against stable.

Out of scope

Any change to what push ships (the next step), and the rubric scorer, which #3781 is moving into a shared package.