31.12.8

chore: publish VS Code extension with managed identity (#2001)

Replaces the Azure DevOps PAT used for VS Code Marketplace publishing
with short-lived Azure Managed Identity credentials obtained through
GitHub Actions OIDC.

## Changes

- **Marketplace authentication**: Grants `publish-marketplace`
job-scoped `id-token: write`, signs in through pinned `azure/login`
using repository secrets, and publishes with `vsce --azure-credential`.
- **Federation boundary**: Rejects manual release workflows launched
from anything other than `main`, matching the managed identity's
branch-bound federated credential while preserving the existing source
`ref` input for trusted patch releases.
- **Operations documentation**: Documents managed identity creation,
GitHub federation, Marketplace publisher authorization, secret
configuration, rollout verification, and removal of the obsolete Azure
PAT secret.
- **Local configuration**: Removes the obsolete Azure PAT entry from the
VS Code extension environment sample.

## Why

Long-lived Azure DevOps PATs create rotation and exposure risk in the
release path. Workload identity federation gives each release a
short-lived credential without moving publishing away from GitHub
Actions or introducing a PAT fallback.

The Marketplace identity has no Azure RBAC assignment; `azure/login`
uses `allow-no-subscriptions: true` because publishing only needs an
Entra token for Marketplace. Open VSX publishing remains unchanged and
continues to use `OPEN_VSX_ACCESS_TOKEN`.

## Verification

- `actionlint .github/workflows/release.yml`
- `prettier --check .github/workflows/release.yml docs/ci-cd.md`
- `git diff --check`
- Confirmed `AZURE_DEVOPS_PERSONAL_ACCESS_TOKEN` and `VSCE_PAT` are
absent from the release workflow and environment sample
- Confirmed the Open VSX publishing block is unchanged

External Azure federation, Marketplace membership, and the
`AZURE_CLIENT_ID` and `AZURE_TENANT_ID` repository secrets must be
configured before running the first release.