#594 Registry scorer fails on bare specifiers — mirror CLI fix from #505

Description

The registry's DenoDocExtensionTarballAnalyzer applies the same hermetic strip+control-config pattern as the CLI's scoreExtensionTarball — it strips the extension's deno.json and writes a controlled config with only { "nodeModulesDir": "auto" } and no imports map. This means deno doc in the scorer cannot resolve bare specifiers like import { z } from "zod".

The CLI side is being fixed in #505 by merging the repo's deno.json imports into the controlled config. But the server doesn't have the repo's deno.json — it only has the tarball — so the server fix requires a different approach.

Affected Extensions

All 5 @twonines/coder-* extensions at v2026.05.31.3 show scorer failures on the Stats panel:

deno doc failed (code 1): Warning Import "zod" not a dependency

Proposed Fix

Embed a swamp-generated import map in the tarball at push time:

1. CLI change (swamp repo): During extensionPushPrepare, capture the resolved imports from the repo's deno.json and write them as .swamp/imports.json (or similar) into the tarball. Only the imports actually used by the extension's source files need to be included.
2. Server change (swamp-club repo): In DenoDocExtensionTarballAnalyzer, if .swamp/imports.json exists in the extracted tarball, merge its entries into the controlled deno.json imports field before running deno doc.

This preserves hermeticity (the import map is authored by the CLI from trusted repo config, not from arbitrary user input) and restores parity between the CLI's quality command and the server's post-publish scorer.

Context

• CLI fix: #505
• Root cause analysis in the #505 comments by @keeb