fix: verify federated VS Code publisher identity before upload

[AlexMikhalev]

Marketplace publisher membership needs the federated principal’s Azure DevOps profile ID. The release workflow previously went directly from Azure login to upload, without checking the authenticated client/tenant or exposing that non-secret identity for setup.

Add a fixed metadata check after Azure login. It validates the service-principal client and tenant, queries its own Azure DevOps profile, and preserves only allowlisted non-secret evidence. Publication stops before vsce while VSCE_MARKETPLACE_PROFILE_ID is unset or mismatched. After the profile receives Contributor access and the expected ID is configured, rerunning the same release’s marketplace planner promotes its already-qualified VSIX. Authentication failures never fall back to a PAT.

Prepare version 0.1.2 because the new step must run from a new immutable version tag; the existing 0.1.1 tag and released bytes remain unchanged. Editor release pins, runtime code and dependency resolutions are unchanged. This uses the existing workflow and tag-protected environment without adding Azure resource permissions or organization membership.

Validation:

• 60 Python tests passed, including malformed identity/configuration, duplicate JSON keys, mismatched client/tenant/profile, immutable receipts, real child-process timeout/error redaction, and workflow ordering. These are local contract tests, not authenticated cloud evidence.
• TypeScript compilation, ESLint, Ruff F checks, actionlint for both VS Code workflows and git diff --check passed.
• 16 actual-WASM host tests and 9 export tests passed.
• Scoped static scan: zero critical findings; six duplicate notices concern three intentional JSON assertions in tests. Two missing test subprocess timeouts were fixed.

The Entra app and federation have been configured, but actual CI authentication, profile retrieval, publisher Contributor assignment and Marketplace publication remain pending. The normal release pipeline must qualify the new VSIX on all three native hosts and verify the live registry payload. This PR does not claim marketplace availability or qualification of all 41 visual requirements.