[ziqq]

The publication workflow now gates Marketplace publishing through environment: release and verifies that the pushed tag, package.json version and first changelog version agree. Checkout and Node setup are pinned to full SHAs; build and deploy default to contents: read, with checkout credentials disabled.

The existing CI called npm test and npm run lint, but neither script exists on master. With the owner's approval, CI now validates VSIX packaging using Node 22 and pinned @vscode/vsce@4.0.0, matching the deploy toolchain. Installation uses npm ci.

Validation:

• CI run 39786791675 passed on 1ab408e33631c350770297e5efb8f55b7df6d963, including VSIX packaging and notification. Semantic label checks and GitGuardian passed.
• actionlint and git diff --check passed.
• All 18 external action references are pinned by SHA.
• Eight release-tag guard scenarios passed, including mismatched versions and a branch ref.
• VSIX packaging succeeded locally (51 files); identity/version match master, and Git metadata, workflows, handoff files and dependencies are excluded.

The archive inspection also found two pre-existing package references: go.mod points to a wrongly named configuration file, and the TOML configuration file is absent. The package manifest is unchanged in this PR; these product issues are outside the workflow changes.

After merge, configure the release environment reviewer/tag policy and repository/tag protection before publishing. Existing secrets and Marketplace PAT authentication are retained. No release or provider configuration is changed by this PR.