chore(deps): bump release tooling patches

[corwinm]

Summary

• Bump @vscode/vsce from ^3.9.1 to ^3.9.2.
• Bump semantic-release from ^25.0.3 to ^25.0.5.
• Refresh pnpm-lock.yaml for the targeted patch updates only.

Audit notes

• pnpm audit --audit-level moderate still reports residual advisories after these patch bumps: tmp and form-data via @vscode/vsce, undici via semantic-release plugins/actions tooling, and js-yaml via @vscode/test-cli > mocha.
• Those remaining findings appear to require additional upstream, override, or broader dependency work, so they are documented here rather than expanding this focused patch PR.

Verification

• pnpm audit --audit-level moderate — fails with 14 residual vulnerabilities (4 low, 4 moderate, 6 high); see audit notes.
• pnpm run check-types — passed.
• pnpm run lint — passed.
• pnpm run package — passed.
• pnpm run verify:release — passed.
• pnpm test — passed (20 passing).

[github-actions]

🎉 This PR is included in version 0.2.0 🎉

The release is available on:

• v0.2.0
• GitHub release

Your semantic-release bot 📦🚀