Epic: rac-editors build-out — recover the extension, gate it, publish it

[tcballard]

Execution tracking (epic) for the rac-editors-buildout roadmap item (ADR-093).

Intent (corpus): rac/roadmaps/rac-editors-buildout.md in itsthelore/rac-core — recover the VS Code / Cursor extension source into vscode/ and execute the v0.21.10 publish contract from its new home.

Iterations (each a reviewable PR here unless noted):

• Corpus intent — the roadmap artifact + runbook touch-up (rac-core#254, merged)
• Source recovery — snapshot-import typescript/rac-vscode from rac-core eed463e^ with provenance; SDK repointed to the published @itsthelore/rac-sdk; typecheck/tests/VSIX proven by CI (feat(vscode): restore the extension source from rac-core [roadmap:rac-editors-buildout] #3, merged)
• CI battery + webview hardening — pr-checks workflow (ADR-027/075) landed with feat(vscode): restore the extension source from rac-core [roadmap:rac-editors-buildout] #3; the hardening regression tests (CSP, bridge envelope, path confinement) landed as test(vscode): pin the webview hardening contract [roadmap:rac-editors-buildout] #5 (merged)
• Release pipeline + listing — vscode-v* tag workflow (publish last, on green, tokenless dry-run), listing metadata/README (chore(release): add the vscode-v* release pipeline and repoint the listing home [roadmap:rac-editors-buildout] #6, merged)

Human-owned blockers (never automated) — everything below is what remains before the first publish:

• Publisher id decision (deferred pending a possible brand re-decision; package.json still carries the recovered publisher: "rac")
• VSCE_PAT + OpenVSX namespace / OVSX_PAT as secrets in this repo
• Branch protection: require pr-checks on main (ADR-075)
• Default branch → main; archive lore-vscode with a redirect note
• First publish: push a vscode-v* tag; then flip v0.21.10 + rac-editors-buildout to Achieved in rac-core and close this epic

Ordering and task state live here; the corpus roadmap remains the record of what and why.