[lsiddiquee]

Summary

• Upgrade Vitest and coverage-v8 together to 5.0.2 and jsdom to 30.1.1, replacing the split major bumps.
• Add a permanent Vitest family Dependabot group covering major updates.
• Declare development Node support as ^22.22.2 || ^24.15.0 || >=26.0.0; CI/dev container stay on Node 24. The packaged gateway Node >=20 runtime requirement is unchanged.
• Add extension packaging to PR CI and publish through the locked workspace vsce instead of unpinned npx.
• Remove obsolete keytar exclusion after the separately validated/merged vsce 4 upgrade (chore(deps): bump @vscode/vsce from 3.9.2 to 4.0.0 #103).
• Preserve existing SHA-512 integrity pins and portable lockfile entries; synchronize README and field notes.

Validation

• Prior failing evidence: chore(deps): bump vitest from 4.1.11 to 5.0.2 #100 coverage passed but warned that mixed runner/provider versions are unsupported; chore(deps): bump @vitest/coverage-v8 from 4.1.11 to 5.0.2 #101 still ran workspace coverage on v4.
• pnpm frozen install, build, typecheck, lint, all-package test:coverage, extension package, and peers check passed on final main-based tree.
• Scoped pre-commit, poetry ruff, and mypy research passed.
• vsce 4 packaging smoke-tested at chore(deps): bump @vscode/vsce from 3.9.2 to 4.0.0 #103 exact rebased SHA; VSIX contents inspected.
• Local installs used the requested package-feed npm/PyPI proxy settings without disabling TLS verification.

Guardrails

No runtime source, RPC contracts, code-sync, egress, localhost binding, provenance, logging, or package-boundary changes. No actuator abstraction, warning suppression, or ts-expect-error added. Existing Vite chunk-size advisory remains unchanged.

Closes #100
Closes #101
Closes #102