D3 — a repo name CHOSEN on a SHARED extension must be namespaced

From the rules_k8s post-mortem, verbatim: “A module extension’s repos are shared across the whole module graph, so oci.pull(name = "distroless_static") here collides with any consumer that pulls a base of that name”. Bazel’s error is “A repo named distroless_static_linux_amd64 is already generated by this module extension”. The shipped fix was to prefix with the module name.

Three distinctions carry the whole gate, and getting any of them wrong makes it useless:

• FOREIGN extension only. Apparent repo names are module-scoped, so two unrelated modules both using @crates is not automatically a conflict — only a shared extension instance can collide.
• CHOSEN names only. rust_toolchains is emitted by the rules_rust extension for everyone, so nobody is choosing it and there is nothing to collide. Flagging it would condemn the documented idiom used by 20+ modules.
• NON-DEV usages only. A dev_dependency extension usage is dropped from every graph but the module’s own, so its repos are never in a consumer’s graph and cannot collide with anything. This mirrors D2, which has always split registersToolchain from registersToolchainDev — the projector emits gate:extDev and this gate simply never read it, so 8 of the 38 findings were modules being told to namespace a repo nobody else can see.

Namespacing is checked against gate:namespacePrefix facts, so rules_jena naming its Maven repo jena_maven passes.