[17/36] Add local build and install script - #63

Verdict: approve with nits. The script itself is safe: no elevation, no curl-pipe-bash, ExecutionPolicy Bypass scoped to the single invocation, strict mode plus per-step exit-code checks.

• Minor, reproducibility: npx @vscode/vsce package (build-and-install.ps1:66) fetches vsce and its sizeable transitive tree from the registry at run time, unpinned, outside npm ci and the lockfile. That's the one place this script pulls remote code, and it makes a reproducible-build script non-deterministic. Pin @vscode/vsce as a devDependency and call the local binary.
• Nit: the .socket/ gitignore addition is unrelated to build tooling and unexplained.
• Nit: Invoke-Checked gates on $LASTEXITCODE, correct for native npm/npx/code, would misreport if code resolves to a non-native wrapper.

Fixed in the stack rework branch at d67c2dce136057670e7d9e96a56bb37f538dd642.

The reproducibility finding is valid. @vscode/vsce is now pinned exactly at 3.9.2 in devDependencies and the lockfile, and build-and-install.ps1 invokes node_modules\.bin\vsce.cmd directly. Packaging no longer fetches an unpinned VSCE tool at runtime.

I did not push this dependency change onto PR63 because the mandatory stack check caught a later package-lock.json conflict. A local PR63 candidate was STACK_CLEAN against immediate child PR51 but STACK_CONFLICT against the full stack tip due to the later PDF.js dependency changes. That candidate was removed without being pushed, and the fix was committed at the dedicated top-of-stack rework branch instead.

The two nits do not require changes:

• .socket/ is the generated cache used by this repository's existing @socketsecurity/socket-patch postinstall step. Ignoring generated dependency-tool state is intentional and belongs with this build/tooling change.
• Invoke-Checked is called with native commands. Automatic VS Code discovery explicitly prefers code.cmd and resolves it through Get-Command; -CodeCommand is a path to the VS Code CLI, not an arbitrary non-native PowerShell wrapper. Native exit failures are reported through $LASTEXITCODE, while PowerShell failures terminate under $ErrorActionPreference = 'Stop'.

Validation on the rework tip:

• PowerShell parsing passes and the local VSCE binary reports 3.9.2.
• npm run compile passes.
• All 494 tests pass.
• The pinned local binary builds the production bundle and packages the VSIX.
• The rework tip remains STACK_CLEAN when combined with the updated PR49 security fix.
• PR63, its immediate child PR51, and the current stack-top PR71 all remain MERGEABLE/CLEAN.