Extension push should follow symlinks in workflows/ directory

Problem

When running swamp extension push, workflow files referenced in the manifest are resolved from the workflows/ directory. However, swamp's own repo structure stores workflow YAML files in .swamp/workflows/workflow-<uuid>.yaml and creates symlinks at workflows/<name>/workflow.yaml pointing to them.

The push command rejects these with: "Symlinks are not allowed in extensions."

This means swamp's own workflow storage design is incompatible with its extension push command — you can't publish workflows that were created with swamp workflow create without manually copying files to replace the symlinks first.

Proposed Solution

The extension push command should follow symlinks when reading workflow files during archive creation. The safety check should ensure the final archive doesn't contain symlinks (which is correct for portability), but the source resolution step should transparently dereference them.

This would be a one-line change in the push command — use Deno.stat() (which follows symlinks, already used) for existence checks, and Deno.readFile() / Deno.readTextFile() (which also follows symlinks) when reading content into the archive.

Affected Components

• src/cli/commands/extension_push.ts — safety analysis step that rejects symlinks
• The safety check likely runs Deno.lstat() to detect symlinks; switching to Deno.stat() or resolving with Deno.realPath() before the check would fix it

Workaround

Manually copy the real workflow files to replace the symlinks before pushing:

for wf in workflows/*/workflow.yaml; do
  if [ -L "$wf" ]; then
    cp --remove-destination "$(readlink -f "$wf")" "$wf"
  fi
done