fix(release): restore npm OIDC registry binding

[davesheffer]

Summary

• restore setup-node's required npm registry configuration for trusted publishing
• permit only setup-node's exact fixed non-secret NODE_AUTH_TOKEN sentinel while rejecting real long-lived credentials
• extend Open VSX's bounded public-index convergence window after the observed delayed visibility
• bump the npm package and active docs/static site to v1.9.2 without changing the already-published VS Code 0.17.3 artifact

Evidence

• npm v1.9.1 validation + Windows/macOS Matrix passed; publish failed with ENEEDAUTH after registry configuration was removed
• Open VSX 0.17.3 published and its public VSIX SHA-256 matches the validated candidate; idempotent rerun passed
• focused release contracts: 10/10 pass
• typecheck and build pass
• Hunch conformance: 4/4; merge verdict: PASS

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hunch	Ready	Preview, Comment	Jul 23, 2026 11:25am

[github-actions]

🧠 Hunch — Engineering Memory Guard

✅ This PR touches no recorded invariants (directly or via blast radius) and re-introduces nothing deliberately retired across 24 changed file(s).

📜 Hunch Constitution — 2 policy receipt(s)

• ✅ pol_01cf084e1e satisfied — symbol:renderAdoptedDoc does not reach symbol:writeFileAtomic
  • receipt: sha1:d216f4b37df29fcaafc4757e4859f605803cfe90
• ✅ pol_3f3aee11ad satisfied — symbol:src/store/db.ts:openDb does not reach external:better-sqlite3
  • receipt: sha1:c41dd2f44b75fc567a4d24e0713ce0e35af38426