#4055 swamp skill docs: publishing.md contradicts itself on dynamic imports, overstates where git dependencies are listed, and never says consumers keep the publisher's bundle

Found while triaging swamp-club#3974, checking the manual against the skill so the two do not disagree. File: .claude/skills/swamp/references/extension-publish/references/publishing.md on swamp main (abfb75f26).

Problems

1. Line 589 lists dynamic imports among those that ship pinned; line 364 says they are rejected during push. Push refuses them at the fmt-lint gate (fixture dynamic-import-ts).
2. Line 606 says git dependencies ship inlined and listed as unaudited. Only package.json git specs are detected, and file:, link:, workspace: and git specs are listed under unaudited only in a package.json-only project (see swamp-club#4053).
3. Line 592 says zod ships as written without saying why: swamp provides zod to every extension, so any npm:zod import is exempt from pinning and audit, and a zod 3 import is inlined into the bundle.
4. No skill doc describes swamp-club#3972: pull, update and auto-resolve keep the publisher's bundle, checked against the v2 record's bundle hashes (a mismatch aborts the install), and rebuild with --no-config only for a bundle format the running swamp does not know, a missing bundle, or a kept bundle that fails to load.

Acceptance

• publishing.md says dynamic imports are refused, in one place.
• The unaudited row matches main (after #4053 if it lands first).
• A short consumers section covers kept bundles, the hash check and when a rebuild happens.