fix: make extension publishing resilient - #104

Summary

• attach the verified VSIX to the GitHub Release before either registry upload
• publish VS Code Marketplace and Open VSX independently with bounded, duplicate-safe retries
• let manual retries reuse the exact attached package, or rebuild a missing legacy asset from its release tag
• run the pinned publishing tools on a supported Node 22 runtime
• reconcile Release Drafter after a pull request is fully merged

Why

The initial v2.3.1 and v2.3.2 release jobs both reached the VS Code Marketplace upload and timed out after about 180 seconds at /_apis/gallery. The former fail-fast sequence then skipped Open VSX and the GitHub Release asset. A targeted retry later published v2.3.1 successfully, confirming that the package, version, and credentials were valid and that the workflow needed transient-failure recovery.

Verification

• complete Node test suite passes under Node 22
• release-policy tests cover independent delivery, bounded retries, exact-tag recovery, package-policy verification, and current CLI engine requirements
• the v2.3.2 recovery VSIX passes the current package verifier

Publishing remains maintainer controlled. This pull request changes delivery reliability only and does not publish a release by itself.