chore(release): add the vscode-v* release pipeline and repoint the listing home [roadmap:rac-editors-buildout]

[tcballard]

Summary

Implements initiatives 2 (release half) and 3 (listing) of rac/roadmaps/rac-editors-buildout.md — the last automatable step before first publish.

Adds:

• .github/workflows/release.yml — adapted from rac-core's pre-v0.22.5 extension-release.yml for this repo: a vscode-v* tag builds, runs the full test gate, packages, and only then publishes — Marketplace then OpenVSX from the same VSIX, with both secrets checked loudly before either publish step so a missing token can never cause a partial publish. workflow_dispatch is a tokenless dry run (VSIX uploaded as an artifact); tag builds also attach the VSIX to the GitHub Release.
• Listing repairs for the new home: the README's cross-repo relative links become absolute (they broke on extraction and would break on a Marketplace listing), the install line uses the rac-core PyPI name, the develop notes drop the file: linkage, the Roadmap section points at rac-editors-buildout, and package.json's repository/bugs point at rac-editors.

Roadmap / ADR Trace

• rac/roadmaps/rac-editors-buildout.md (merged as rac-core#254) — initiatives 2/3; the publish contract is v0.21.10
• ADR-068 — single shared VSIX to both registries
• Execution tracking: Epic: rac-editors build-out — recover the extension, gate it, publish it #2

Scope

Included

• The release workflow and the factual listing-home repairs above. The no-telemetry/offline posture was already stated in the README's Privacy section (v0.21.10 initiative 3's selling point) — unchanged.

Excluded

• The publisher/displayName identity — deliberately untouched (rac / "RAC — Requirements as Code", the recovered values). The listing-identity decision is fenced and human-owned; first publish blocks on it.
• The first publish itself: human-owned (VSCE_PAT, OpenVSX namespace + OVSX_PAT as repo secrets, then a vscode-v* tag).

Product / Architecture Decisions

• Publish steps are tag-gated and sequenced after the full battery in one job, so a red gate makes them unreachable; the secrets check runs before either registry is touched, eliminating the partial-publish failure mode.
• CI installs rac from PyPI — this repo consumes the public contract only (ADR-063).

User-Facing Contract

No published surface yet. Once the human-owned steps land, git tag vscode-v0.1.0 && git push --tags produces the first Marketplace + OpenVSX release with auto-update.

Verification

Ran (locally)

• npm run check-types — clean after the manifest edits
• npx vsce package — VSIX builds (11 files)

Proven by CI

• The battery on this PR (README/package.json changes ride through it).
• The release pipeline itself is verifiable tokenlessly after merge via workflow_dispatch — everything runs except publish, and the VSIX lands as a run artifact.

Review Path

1. .github/workflows/release.yml
2. vscode/package.json (repository/bugs only)
3. vscode/README.md (links and install text)

Notes For Reviewer

After merge, the remaining path to a live listing is entirely maintainer-owned: publisher-id decision (pending the possible brand re-decision), Marketplace/OpenVSX accounts + secrets, branch protection for pr-checks, then the first tag. The rac-core closeout PR (flipping v0.21.10 and rac-editors-buildout to Achieved) follows the first successful publish.

Implementation Process

Implemented with AI assistance under the roadmap contract; final scope, review, and acceptance decisions were made by the maintainer.