Fix release stamping, packaging and publishing gates

[MelbourneDeveloper]

TLDR

Fix release version stamping, Native AOT distribution, and Marketplace authentication, with a publishing preflight before tagging.

What Was Added?

• Shared Marketplace authentication action: prefer configured Entra OIDC, otherwise use the existing PAT, and verify publisher access with pinned VSCE 4.0.0.
• Manual Release preflight that checks manifests, publishing credentials, CI and CodeQL without publishing.
• Shared Make/CI version test setup fetching the complete locked dependency graph before offline metadata verification.
• test_release_preserves_locked_cargo_dependencies exercising stable and prerelease stamping against the real Rust workspace.

What Was Changed or Deleted?

• Stamp workspace entries in Cargo.lock together with Cargo.toml while preserving registry dependencies.
• Use numeric extension manifest versions for Marketplace; binaries and Shipwright expectedVersion retain the full prerelease version.
• Stamp Native AOT builds, archive the complete publish output including SQLite runtime libraries, then smoke test the extracted archive.
• Require tag pushes and successful dependencies on every publishing path; VSIX publishing supports retries with skip-duplicate.

How Do The Automated Tests Prove It Works?

• test_release_preserves_locked_cargo_dependencies asserts unchanged registry packages/checksums, stamped workspace versions, and successful real cargo metadata --locked --offline for stable and beta versions.
• test_release_carriers checks numeric VSIX versions, full binary/manifests versions, and dry-run immutability.
• Final make ci passed: .NET and Rust suites, 70 extension integration tests, coverage gates, and final build. Exhaustion 1.0.1 remained enabled; latest peak process-tree memory was 1.72 GiB with no watchdog intervention.
• The shared version test target also passed from a completely empty Cargo cache, preserving every offline and lockfile assertion.
• Actionlint and composite-action shellcheck passed. Deslop passed with no changed Python file clusters.
• Native AOT workflow now executes its migration smoke test from each extracted distribution before artifact upload.

Spec / Doc Changes

Document lockfile stamping, cold-cache dependency setup, native archive dependencies and smoke tests, Marketplace versioning/authentication, and publishing preflight in the CI spec. Trim redundant Makefile comments to keep it under 450 lines.

Breaking Changes

• None