ci: add CI job for VS Code extension

[lizhengfeng101]

Description

The VS Code extension (extensions/vscode/) has a full development toolchain — TypeScript compilation via webpack, ESLint, and 10 Jest test files — but no CI workflow validates any of it. Every PR that touches only extension code gets a green check from the Go-only ci.yml job, which provides zero signal about whether the extension still compiles or passes tests.

This gap becomes critical with PR #437 proposing to enable dependabot for the extension's npm dependencies: automated dependency PRs would merge with no build or test validation.

Scope

• New file: .github/workflows/vscode-ext.yml
• Directory under test: extensions/vscode/

Suggested Implementation

The workflow should follow existing CI conventions (self-hosted runner, explicit timeout, node:24 container, Trust workspace step):

name: VS Code Extension

on:
  push:
    branches: [main]
    paths: ['extensions/vscode/**']
  pull_request:
    branches: [main]
    paths: ['extensions/vscode/**']

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  check:
    runs-on: self-hosted
    timeout-minutes: 10
    container:
      image: node:24
    defaults:
      run:
        working-directory: extensions/vscode
    steps:
      - uses: actions/checkout@v4

      - name: Trust workspace
        run: git config --global --replace-all safe.directory '*'
        working-directory: .

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Lint
        run: yarn lint

      - name: Compile
        run: yarn compile

      - name: Test
        run: yarn test

Key design decisions:

• Path filter (extensions/vscode/**): avoids running on unrelated Go changes
• yarn install --frozen-lockfile: validates lockfile integrity (catches broken dependabot updates)
• yarn compile (dev mode webpack): verifies TypeScript compiles without production optimization overhead
• Timeout 10 min: generous for a job that should complete in ~2 minutes
• No vsce package: packaging is a release concern, not a CI gate

Acceptance Criteria

• New workflow file .github/workflows/vscode-ext.yml is created
• Workflow triggers on push/PR to main only when extensions/vscode/** changes
• yarn install --frozen-lockfile passes (lockfile is consistent)
• yarn lint passes (ESLint clean)
• yarn compile passes (TypeScript + webpack build succeeds)
• yarn test passes (all 10 Jest test suites green)
• actionlint reports no errors on the new workflow file

Context

• Blocked by: PR chore(deps): let dependabot cover the VS Code extension #437 (dependabot for VS Code extension) should not merge until this CI exists
• Related: the extension already has hand-patched resolutions in package.json for 5 CVEs, indicating active but unautomated security maintenance
• The extension uses Yarn Classic (v1) with a tracked yarn.lock