a published surface is not only markdown

add appended .md unconditionally, so openapi.json became openapi.json.md. Reported
from use against a repository that publishes an OpenAPI document beside its prose.
It is now supplied only when the name carries no extension of its own.

Two consequences came with it that the report could not have seen. A facet's name
was built by stripping the extension, so openapi.json would have taken
openapi.usages.md and collided with the facet for a sibling openapi.md; only a
trailing .md is stripped now. And the unlocked walk matched *.md only, so a
hand-fetched .json under .loom/externals was adopted, unlocked, and invisible to
check; it now walks everything that is not the lock file or a dotfile.

The assumption was never decided, it was typed. externals says a repository
publishes documents and publication says prose in whatever form its readers need.
Neither says markdown and three places in this tool did.

Also records that the wrong diagnosis cost more than the bug: the repository is
private, a scratch config with no token made every fetch look broken, and loomctl
config would have said so in one line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

internal/external/polad.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"git.hypertheory-labs.dev/loom/loom-cli/internal/lock"
 )
@@ -59,7 +60,7 @@ func poladLockPath(root string) string {
 // usually survive unchanged — what moves is the manifests, the config, the code
 // that a usage named, which is why a usage names them.
 func usagesFor(root, rel string) (string, bool) {
-	p := rel[:len(rel)-len(filepath.Ext(rel))] + ".usages.md"
+	p := strings.TrimSuffix(rel, ".md") + ".usages.md"
 	_, err := os.Stat(filepath.Join(root, lock.Dir, filepath.FromSlash(p)))
 	return p, err == nil
 }