#3970 Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

Repo: swamp. Step 2 of the extension dependency-forms design. Depends on #3969. Design: the extension dependency-forms Doc, https://claude.ai/artifact/WpRbpqb5djPgDXzydFSohs (decided 2026-10-26).

Problem

Push ships dependencies the way the author wrote them, so ranges and import-map targets reach the archive. Every later step (the audit, the record, the registry, consumer rebuilds) re-interprets them, each a little differently. A consumer rebuild of npm:ms@^2 fetches whatever the registry serves that day, not the audited version.

Proposal

• Push rewrites every npm:/jsr: import site to the exact version the bundle contains, read from the S1 graph: npm:<name>@<x.y.z>[/subpath] or jsr:@<scope>/<name>@<x.y.z>[/subpath]. The one exception is npm:zod@4, which the host provides.
• extension/dependency-audit.json moves to recordVersion: 2. It holds one entry per shipped package version with spec == version, from and writtenAs, an unaudited list (origin and module hashes for URL, git and non-registry package.json code, which is vendored into the archive), and the bundle's SHA-256.
• No deno.json, deno.jsonc, deno.lock, package.json, package-lock.json, .npmrc or node_modules in the archive. A config or lock file found in kind dirs or additionalFiles is left out, with a warning naming it.
• Consumer rebuilds of pulled source pass --no-config.
• Lock rule: a non-exact spec costs the loose point only when no valid lock resolved it. deno.lock always counts. A package-lock.json counts only when node_modules matches it, otherwise it's treated as no lock, with a warning. The push warning names the fix and the point, for example: "no lock: ^2 resolved to 2.1.3 today; commit a lock or pin exact versions (costs 1 point)".
• The shared dependency_audit_vectors.json gains a canonical section.

Acceptance

• A written range with a lock, an import-map range and a lockless range each ship exact. Only the lockless one warns.
• The v2 record shape matches, including the bundle hash and the unaudited list.
• A URL import and a file: package.json dependency still push and appear under unaudited.
• UAT: a swamp-uat item covering the canonical shipped form (U1 in the Doc), with strict JSON schemas updated.

Out of scope

Registry scoring of v2 archives (swamp-club step C1), and consumer bundle reuse (S4).