docs: document Marketplace and Open VSX distribution (v0.1.4)

[TheStreamCode]

Problem

The extension is published as mikesoft.vscode-kimi-code-cli-launcher on the VS Code Marketplace (0.1.3) and on Open VSX (0.1.3), but the README only documented installing a VSIX from a GitHub release. Since the Marketplace listing renders this README, users arriving from either registry were pointed away from the channel they were already on, and the extension id was never stated anywhere.

Changes

• README — VS Marketplace and Open VSX version badges (both verified live before committing); a new ## Installation structure with Marketplace, Open VSX, and VSIX subsections; the extension id in the At a Glance table; Quick Start step 3 now points at the registries.
• README, Build and Release — names the real manual publish commands (vsce publish --packagePath, ovsx publish) and states that no publisher token is present in the repository, the shell environment, or GitHub Actions secrets, so neither CI nor an agent can publish.
• .vscodeignore — removed the dead SECURITY_REVIEW.md rule. The file moved to docs/SECURITY_REVIEW.md, which docs/** already excludes; npm run package:list returns the same 13 files before and after.
• AGENTS.md — records the published channels and the token policy, the branch-protection flow, scripts/generate-icon.ps1 as the deterministic source of media/icon.png, and the extended release-sync checklist.
• Tests — new README documents every published distribution channel metadata test; existing version assertions moved to 0.1.4.
• Version — 0.1.3 to 0.1.4 (patch: documentation and packaging metadata only), synchronized across package.json, package-lock.json, CITATION.cff, README, metadata tests, and CHANGELOG.md.

No runtime source file was touched. src/extension.ts and src/command-utils.ts are byte-identical to main.

Validation

All run locally on Windows 11 / Node 24.18.0 against this branch:

• npm run lint — 6 files, no findings
• npm run format:check — 6 files, no findings
• npm run typecheck — clean
• npm test — 23/23 unit + metadata tests pass; VS Code 1.131.0 Extension Host smoke test exits 0
• npm run package:list — 13 files, identical to main
• npm run check:security — found 0 vulnerabilities
• npm run package — vscode-kimi-code-cli-launcher-0.1.4.vsix, 65.24 KB, 15 zip entries, manifest Version="0.1.4"; no .env, key, source, test, script, or map file inside
• git diff --check — clean

Also verified out of band: scripts/generate-icon.ps1 regenerates media/icon.png byte for byte (identical SHA-256) in an isolated copy, so the published artwork cannot be silently altered by running it; no asset was modified by this PR.

Risks

• The VS Marketplace badge uses vsmarketplacebadges.dev. shields.io retired its visual-studio-marketplace/* badges and now serves a literal "retired badge" image, so it was not an option. The chosen endpoint was verified to return the real live version. If that third-party host ever disappears, the badge line is a one-line removal.
• The README now advertises vscode-kimi-code-cli-launcher-0.1.4.vsix, which exists only once a v0.1.4 tag is pushed and the Release workflow runs. Merging without tagging leaves that one filename ahead of reality.

Follow-up for the maintainer

This PR does not tag or publish. After merge:

1. git tag v0.1.4 && git push origin v0.1.4 — the Release workflow validates, audits, packages, and creates the GitHub release.
2. vsce publish and ovsx publish with your own tokens, if you want 0.1.4 on the registries.

🤖 Generated with Claude Code