#3971 Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

Repo: swamp. Step 3 of the extension dependency-forms design. Depends on #3969 and #3970. Design: the extension dependency-forms Doc, https://claude.ai/artifact/WpRbpqb5djPgDXzydFSohs (decided 2026-10-26).

Problem

Some inputs Deno accepts are decided only by Deno, with no swamp test, and some leak. Push never passes --no-config, so a deno.json above the repo (for example in $HOME) silently shapes what ships. Workspace configs probably read the wrong lock. A JSR dist-tag is an error while an npm one only warns.

Proposal

• The resolver reads a workspace's root lock, the one Deno uses.
• An ancestor config is ignored with --no-config and refused by name, with the fix: a deno.json inside the repo. This is the only input that stops working. Seth decided on refusal, with no notice period.
• deno.json plus package.json is one graph read, so the bundle, the shipped specifier and the audit agree.
• JSR dist-tags resolve through Deno and ship exact.
• Docs: the swamp skill's publishing.md and the design docs are rewritten once against the final design. That includes #3793: each installed copy under one declared range is audited and recorded separately, and a written npm: import no longer hides one.

Acceptance

• A fixture per category passes: a workspace member pushes with the root lock; an ancestor config is refused by name; a JSR dist-tag ships exact; a URL import and a file: dependency push, pull and run; config files in additionalFiles are left out with a warning.
• UAT: a swamp-uat item covering the newly accepted inputs (U3 in the Doc).