ci: enforce app-server release gates

[oratis]

Summary

• add a real packaged app-server release gate with protocol, persistence, boundary, bundle, and timing budgets
• enforce the gate on Ubuntu, macOS, and tag validation alongside the desktop Playwright journey
• package a versioned VSIX as a GitHub Release artifact and delay npm publication until VSIX and signed DMG builds succeed
• document additive migration, isolated-home rollback drills, budget-change policy, and post-build DMG smoke checks

Measured baseline

• extension.cjs: 31,814 bytes, budget 64 KiB
• app-server.cjs: 599,351 bytes, budget 768 KiB
• VSIX: 185,057 bytes, budget 256 KiB
• cold initialize: about 42 ms locally, budget 5 s
• workspace diff: about 151 ms locally, budget 10 s
• thin-client scan: 53 production source files, zero violations

Validation

• pnpm release:check
• desktop Playwright journey: 4 passed
• pnpm test: 1028 passed, 12 skipped
• pnpm lint: no errors, one pre-existing warning
• pnpm format:check
• pnpm docs:check
• workflow YAML syntax check

Stacked on #207.

[oratis]

Review: approved ✅

Gates that run against real packaged artifacts rather than source. That distinction is the whole value: #202 already found an import.meta.url crash that only appeared in packaged CJS sidecars, which source-level CI cannot see.

On the budgets — measured, with headroom, and each has a stated baseline:

artifact	measured	budget
extension.cjs	31,814 B	64 KiB
app-server.cjs	599,351 B	768 KiB
VSIX	185,057 B	256 KiB
cold initialize	~42 ms	5 s
workspace diff	~151 ms	10 s

The timing budgets are ~100× the local measurement, which is right for CI runners — a timing gate tight enough to be informative is a timing gate that flakes. The size budgets are ~1.3–2× and are the ones that will actually catch regressions. Requiring before/after measurements in the PR description to raise a budget is the part that keeps them from being ratcheted up silently.

The thin-client scan is the gate I value most: 53 production source files, zero violations, asserting that desktop/VS Code/LSP sources do not import the provider, credentials, agent loop, or RuntimeHost. Everything from #192/#195/#196 is otherwise a point-in-time property that the next convenient import quietly undoes. This makes it enforced.

Release-ordering change is correct: publishing the VSIX as a Release artifact and delaying npm publication until VSIX and signed DMG builds succeed fixes a real hazard — npm publish is effectively irreversible, so it must be the last step, after the failure-prone platform builds. Previously a DMG/notarization failure could leave a published npm version with no matching desktop build.

Documenting isolated-home rollback drills and post-build DMG smoke checks is good; those are manual, so their value depends on actually running them at release time.

Validation: CI green on Ubuntu, macOS, and tag validation.