feat: automate releases for the VS Code-only distribution

[mrpatpat]

Summary

• calculate extension versions from Conventional Commits on main
• publish the VSIX, checksum, generated notes, and provenance attestation automatically
• remove the CLI and MCP workspaces, dependencies, documentation, and backend-only API surfaces
• keep the core package private and bundled into the VS Code extension

Validation

• npm ci
• npm run check
• npm test (17 tests)
• npm run package:vscode
• workspace/lockfile audit: only packages/core and packages/vscode
• source audit: no CLI or MCP references
• semantic-release dry run: v0.1.0 -> v0.2.0