ci: verify Marketplace identity access

[realSilasYang]

Summary

• document the repository's verified OIDC subject format
• add an optional non-publishing Marketplace permission check
• lock both behaviors into the release-readiness contract

Verification

• npm run verify
• npm run lint
• npx --yes prettier@3.6.2 --check .github/workflows/marketplace-identity.yml docs/RELEASING.md
• git diff --check

[Copilot]

Pull request overview

This PR strengthens the repository’s release/publishing security posture by documenting the verified GitHub OIDC sub (subject) format used for Azure federated credentials and by adding an opt-in workflow step that verifies Marketplace publishing permissions without publishing anything. It also updates the “release readiness” verification script to enforce both the workflow and documentation requirements as part of the repo’s release contract.

Changes:

• Add an optional workflow_dispatch boolean input (verify_marketplace_access) to the Marketplace identity workflow to run a non-publishing permission check via vsce verify-pat --azure-credential.
• Document the repo’s current verified OIDC subject prefix (including org/repo numeric IDs) and provide a CLI-based way to confirm the sub_claim_prefix before creating the Azure federated credential.
• Lock both the new workflow input/permission-check behavior and the documented OIDC subject format into scripts/verify-release-readiness.js.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
scripts/verify-release-readiness.js	Enforces presence of the new workflow input, vsce verify-pat usage, and the documented OIDC subject format as release-readiness requirements.
docs/RELEASING.md	Documents how to confirm the repo’s OIDC sub prefix and adds explicit instructions for optional Marketplace permission verification.
.github/workflows/marketplace-identity.yml	Adds an opt-in boolean input and a conditional step to verify Marketplace publishing permission via Azure credential (without publishing).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.