#484 Add integration test for sensitive-arg guard on lazily-loaded extension types (follow-up to #480)

Problem

The swamp-club#480 fix (PR systeminit/swamp#1469) had a real defect found only during manual clean-room verification: the YamlDefinitionRepository.save() chokepoint resolves the type schema via the model registry, but for an extension type the registry lazy-registers it. model edit never pre-loads the registry, so modelRegistry.get(type) returned undefined, the guard silently passed, and a literal sensitive value leaked to disk via model edit.

The fix (ensureLoaded() + ensureTypeLoaded() to promote the lazy type) works, but no automated test covers it. The existing unit/integration tests register types via defineModel, which fully registers them in models — so get() succeeds without the lazy-resolution fallback, and the tests would not have caught (and would not catch a regression of) the edit leak.

Proposed solution

Add an integration test that:

• Sets up a real extension model under extensions/models/ (lazily loaded via the bundle catalog, not defineModel).
• Edits a definition of that type to a literal sensitive global arg via model edit (stdin), and asserts the write is refused and nothing is persisted.
• Optionally drives model run/serve for the same lazy-type to lock in chokepoint coverage across writers.

Context

Follow-up to swamp-club#480. The gap is specifically the lazy extension-bundle resolution path in src/infrastructure/persistence/yaml_definition_repository.ts save().