infra: CI never packages the extension, so only publishing finds a broken manifest

[GabrielBBaldez]

ci.yml runs npm ci, npm run compile, npm test. All three can pass on a commit that cannot be packaged into a .vsix at all, because nothing here ever builds one.

That gap sits directly under #1. Publishing is the step where a manifest problem surfaces, and it surfaces interactively, against the real Marketplace, on the one occasion where a mistake is most expensive. vsce refuses a package over things the TypeScript compiler has no opinion about — a missing or wrong-format icon, a repository field it can't resolve, a LICENSE it can't find, an engines.vscode that doesn't match the installed @types/vscode, files that .vscodeignore excluded but the entry point needs.

@vscode/vsce isn't even a devDependency today, so there is no local way to check either.

What to do

1. Add @vscode/vsce to devDependencies and a script:

   "package": "vsce package --out stacktale-vscode.vsix"

2. Add a step to .github/workflows/ci.yml after npm test that runs it and uploads the result with actions/upload-artifact, with if-no-files-found: error so a silently-absent file fails rather than passing.

Two details that decide whether this is worth having:

• Fail on warnings. vsce package warns rather than errors on several of the problems above, so a green step can still hide them. Decide whether to pass --allow-star-activation and friends explicitly or to let warnings fail the step, and write down which you chose and why. The point of the step is to be the thing that says no.
• Uploading the .vsix is half the value. Anyone reviewing a PR can then download it and install it with code --install-extension to try the change, without setting up a TypeScript build. Say so in the PR so people know it's there.

Worth knowing: vsce package fails if README.md contains relative image links, because the Marketplace can't resolve them. If that bites, it's a real finding about the README, not a reason to skip the check.

Verify

Push a commit that deliberately breaks the manifest — for instance point icon at a file that doesn't exist — and watch the new step fail while compile and test stay green. Revert, confirm the .vsix artifact appears on the run, download it, and install it into VS Code.