#602 extension quality scorer mis-detects quoted phrases in comments as bare imports

Summary

swamp extension quality (and the same path in swamp extension push --dry-run) extracts import specifiers from extension source, but the extraction also scans inside // comments. A double-quoted multi-word phrase in a comment is treated as a module specifier, and because it cannot be resolved the command fails fatally — even though the extension has no such import.

swamp version: 20260608.234005.0-sha.ed5f78a4

Reproduce

Any extension whose source contains a comment with a double-quoted phrase, e.g.:

// A genuinely absent PolicyDocument is left untouched and keeps its
// existing "no policy" behavior.

import { z } from "npm:zod@4"; // the only real import

Run:

swamp extension quality manifest.yaml

Actual

FTL error Error: 'Extension uses bare import specifiers that cannot be resolved by the server-side scorer: "no policy". Use explicit npm: or jsr: prefixes in your source files (e.g., "npm:package@version").'

The reported "specifier" no policy is text from a comment, not an import. The only real import (npm:zod@4) is correctly prefixed.

Expected

Comments should be stripped (or otherwise excluded) before import-specifier extraction. Only actual import / export ... from / import(...) specifiers should be evaluated. A quoted phrase inside a comment should never be treated as a module specifier.

Notes

• The check exits on the first fatal error, so in a multi-extension repo only the first offending extension surfaces; others may hide the same issue.
• A space-containing token like no policy can never be a valid bare specifier, which is an additional signal that the matched text is not an import.

Workaround

Reword the comment so it contains no double-quoted phrase (use backticks, single words, or no quotes):

-        // Distinguish "policy attached but unreadable" from "no policy". When
-        // string) is left untouched and keeps its existing "no policy"
-        // behavior.
+        // Distinguish the policy-attached-but-unreadable case from the
+        // no-policy case. When ... is left untouched and keeps its existing
+        // no-policy behavior.