Add tag-driven publish workflow with GitHub Release

[azizbecha]

Summary

• New .github/workflows/publish.yml triggered by v*.*.* tag push (and manual workflow_dispatch); runs lint / format:check / test / compile / package, then publishes to the VS Code Marketplace and Open VSX, and creates a matching GitHub Release with the corresponding CHANGELOG.md section as the body and the built .vsix attached.
• Tag verification step refuses to run if the pushed tag and package.json version disagree.
• release:patch / release:minor / release:major npm scripts wrap npm version <type> -m 'Release v%s' && git push --follow-tags so a single command bumps, tags, and triggers the workflow.
• Open VSX step is continue-on-error: true so an Open VSX outage doesn't block the GitHub Release / Marketplace publish.
• PUBLISHING.md updated to document the automated flow, the VSCE_PAT / OVSX_PAT secrets, and the manual-dispatch toggles.

Test plan

• Add VSCE_PAT (and optionally OVSX_PAT) to repo Secrets
• Confirm package.json publisher matches a publisher you own on the marketplace
• Once merged, run npm run release:patch (or higher) and watch the Publish workflow run end-to-end
• Verify the Marketplace listing, Open VSX listing, and GitHub Release with the .vsix attachment all appear