core: fold the rest of extension resolution (TOML read, bare-name gating, spec build) into Rust #1111

Part of #1072. Follow-up to #1078, which landed only the argv config-path scan (dirsql::launcher::config_paths_from_argv, PR #1106).

What is left

The rest of the cluster #1078 measured is still a Python/TypeScript port of one another:

Only importlib.util.find_spec / require.resolve are host-specific. Everything else is language-neutral and the core already carries clap and toml.

Shape (from #1078)

The core exposes a resolution plan over argv plus config contents; each launcher answers "where is package X installed on this host" and hands the answer back; the core builds the path::entrypoint specs and the --extension flags.

Why it was split off

• Crosses three TOML parsers (tomllib / smol-toml / the toml crate) whose error surfaces differ, and the SDK constructor's config= path also reaches this code, so which errors come from the launcher versus the core must stay identical.
• The is_bare_name suffix lists differ (.pyd vs .node), so it is not pure duplication.
• The TypeScript launcher defers smol-toml behind an existsSync guard (Minor packaging trims: drop npm sourcemaps, lazy-import smol-toml on the CLI path #720); a core call that reads config on every launch would regress startup.
• XL by review surface on its own; core: fold the language-agnostic half of extension resolution into Rust (three argv parsers today) #1078's slice A was M.

Constraints

Same as #1072: public API surface unchanged, no existing test rewritten or weakened, PARITY.md updated if any SDK-visible surface moves.