#508 Extension quality/adversarial-review: add a 'published-surface hygiene' check for real infra identifiers

Problem

The extension quality gates catch secrets (adversarial-review.md → "Credentials & Secrets": vault + .meta({sensitive:true})) and the safety analyzer catches file types/sizes/eval, but nothing audits the content of shipped non-code files for real infrastructure identifiers.

An extension can reach Grade A while its README.md examples (and additionalFiles, and repo-visible *_test.ts fixtures) embed real production IPs, hostnames, jump/bastion addresses, and internal topology. Authors only avoid this by personal diligence — exactly what a rubric should catch.

Concrete repro

Building @stateless/proxmox (a Proxmox guest-lifecycle model):

• swamp extension quality manifest.yaml --json → earnedPoints: 14 / 14, percentage: 100, status: passed.
• swamp extension push --dry-run → passed.

…while README.md config examples contained a real Tailscale jump IP, the node's real internal IP, and real internal subnet addressing (copied verbatim from a working globalArguments block). No gate flagged it. It was caught only by a human reviewer.

Proposed solution

Add a universal adversarial-review dimension — "Published-surface hygiene" — asserting that README, examples, additionalFiles, and *_test.ts fixtures use placeholder values (RFC 5737 192.0.2.0/24 / 198.51.100.0/24 / 203.0.113.0/24, RFC 1918 framed as examples, example.com) rather than real infra identifiers or internal topology.

Optionally enforce it as a quality-rubric factor: a heuristic scan at push/quality time over the shipped doc/example/fixture files that warns on IP-literal and hostname patterns, so it is enforced rather than advisory.

Alternatives considered

• Rely on author diligence (status quo) — demonstrably fails.
• Document the guidance in the swamp-extension skill without a check — weaker; easy to miss.
• A push-time lint flagging IP/hostname literals in additionalFiles + README (warn, not hard-fail, to avoid false positives on intentional public examples).