chore: refresh dependencies and add VS Code Marketplace publishing

[Coderrob]

Description

Refresh compatible dependencies, group Dependabot updates with a 12-day cooldown, and add manual Visual Studio Marketplace publishing using the locked official vsce CLI.

Marketplace publishing

• Add publish-vscode.yml, manually dispatched from main with an existing stable release tag or the repository's _COMMIT suffix convention.
• Verify ancestry on main, extension identity (coderrob.barrel-roll), manifest/lockfile versions, matching commit suffixes, and the tagged commit's locked CLI dependency. Run quality, type, coverage, memory, and packaging checks before publishing the resulting VSIX.
• Authenticate using the VSCE_PAT repository Actions secret and run vsce publish --packagePath. The token is exposed only to the final publish step; no separate identity/login Action is needed.
• Pin @vscode/vsce 4.0.0 as a development dependency. Local packaging, CI, and GitHub releases use that locked CLI. CI now creates a real VSIX on Linux, Windows, and macOS.
• Document setup and release instructions in README, CONTRIBUTING, AGENTS, and the changelog.

Dependency maintenance

Refresh npm packages and transitive dependencies; update checkout 7.0.1, setup-node 7.0.0, and action-gh-release 3.0.3 with immutable commit pins. Add weekly npm/Actions groups with a 12-day cooldown and separate security-update groups. Retain TypeScript 5 / ESLint 9 for peer compatibility and VS Code typings for the supported 1.80 API; align Node development prerequisites.

Supersedes the already-closed #25, #26, #27, #28, #29, and #31. Their dependency fixes remain included.

Validation

• npm 10 clean-install validation matching CI; registry release ages, integrity hashes, Node engines, and direct peer constraints verified. The locked vsce release also satisfies the 12-day policy.
• npm run quality, npm run typecheck, npm run coverage:verify (354 tests), npm run memory:check, and npm run ext:package passed locally.
• All per-file coverage gates passed: 99.86% statements/lines, 98.22% branches, and 100% functions.
• actionlint passed for publishing, CI, and release workflows. Executed the workflow's metadata checks against matching and rejected tag/identity fixtures. Token-authentication smoke checks verify missing-token failure, exact publish arguments, and token isolation to the publish step.
• Inspected the generated VSIX: correct publisher/name/version and exactly the five intended payload files, accounting for VSCE's LICENSE.txt/readme.md normalization.

First-publish setup

Add a repository Actions secret named VSCE_PAT containing a Marketplace publishing token with Marketplace Manage scope, from an account authorized to publish under coderrob. Setup instructions are in README.

No Marketplace workflow has been dispatched and no extension has been published.

Remaining advisories

npm audit reports seven findings (four high, three moderate) in depcheck's development tree, rooted in braces and sprintf-js. Their latest releases remain affected. No forced downgrade or tooling replacement is included.