#309 extension push drops binaries: field from re-emitted archive manifest.yaml

Summary

swamp extension push strips the new binaries: field when it re-emits the archive's manifest.yaml. The field is correctly sent in the wire pushMetadata and the binary payload is staged with the right mode bits, but the on-disk manifest.yaml inside the tarball does not carry binaries: through.

Pull reads manifest.yaml from the extracted archive (src/libswamp/extensions/pull.ts line 753-763), so:

• The renderer's "This extension includes executable binaries — inspect before use" warning never fires (src/presentation/renderers/extension_pull.ts line 60).
• The pull-side chmod 0o755 step is skipped (src/libswamp/extensions/pull.ts line 963).
• swamp extension pull --json reports binaries: [] even when the extension declared one.

The binary still lands executable in practice because extractTarGz honors the stored tar mode bits, but the security warning — the main user-visible value of the new binaries: field over additionalFiles: — is silently lost.

Root cause

src/libswamp/extensions/push.ts lines 1027-1064. The stringifyYaml({...}) call that re-emits the archive manifest enumerates fields explicitly and omits binaries:

await Deno.writeTextFile(
  join(extDir, "manifest.yaml"),
  stringifyYaml({
    manifestVersion: input.manifest.manifestVersion,
    name: input.manifest.name,
    version: input.manifest.version,
    // ... other fields ...
    additionalFiles: input.manifest.additionalFiles,
    // <-- binaries: input.manifest.binaries is missing here
    ...
  }),
);

Compare with pushMetadata at line 657-659, which does include the field — so the field is honored end-to-end except in the on-disk archive manifest.

Steps to reproduce

1. Author an extension with a binaries: entry in its manifest, e.g.:

   binaries:
     - bin/foo

2. Run swamp extension push <manifest> --dry-run.
3. Inspect the staged archive's manifest:

   tar -xzOf <cached>/extension.tar.gz extension/manifest.yaml | grep -A2 binaries:

4. Observe that no binaries: key is present, even though the source manifest declared one.

Reproduced on 20260509.235714.0-sha.7ace6b02 while migrating @hivemq/mudroom's bin/mudroom from additionalFiles: to binaries:.

Suggested fix

Add the field to the re-emit alongside additionalFiles in push.ts:

additionalFiles: input.manifest.additionalFiles,
...(input.manifest.binaries.length > 0
  ? { binaries: input.manifest.binaries }
  : {}),

A regression test could assert that a round-trip through extensionPush preserves the binaries: field in the archive manifest.

Environment

• swamp 20260509.235714.0-sha.7ace6b02
• Linux 6.18.15 (also relevant to darwin since extractTarGz behavior is identical)