[Ticket]: configure should write lightbridge.* into VS Code settings

## Summary

`governance-auth configure` writes inference and telemetry wiring for Claude Code, Codex and VS Code Copilot, but does **not** write the two settings the Lightbridge VS Code extension needs. Developers set them by hand, and get them wrong.

## Evidence this is a real onboarding cost

During live setup the base URL was hand-entered as `https://api.ai.camer.digital/v1`. The extension appends `/v1/models/info` itself, so that produced `/v1/v1/models/info`. `configure` already holds the correct value.

## What to write

| Setting | Value | Gate |
|---|---|---|
| `lightbridge.gatewayUrl` | `config.gateway_url` (bare host — the extension appends `/v1/...`) | `gateway_url.is_some()` |
| `lightbridge.governanceAuthPath` | `std::env::current_exe()`, absolute | `gateway_url.is_some()` |

`governanceAuthPath` matters more than it looks: the extension spawns without a shell, so `PATH` depends on how VS Code was launched, and a desktop- or snap-launched editor often lacks `~/.local/bin`. Same class of trap as ADR-0012's note that Codex spawns `auth.command` without a shell.

## The structural catch

`configure_vscode` lives in `otel.rs` and returns early when there is no OTLP endpoint:

```rust
let Some(endpoint) = settings.endpoint.as_deref() else { return Ok(Vec::new()); };
```

with the doc comment *"VS Code Copilot's OTEL surface is telemetry-only — there is no gateway/inference setting this writer could touch instead."*

**That comment is now false** — `lightbridge.*` is exactly the inference setting it says does not exist. The keys cannot simply be appended to that function: they would inherit the telemetry gate and never be written for someone who has a gateway but no collector. Split the writer so telemetry keys stay gated on `otel_endpoint` and `lightbridge.*` gates on `gateway_url` (the same gate `oauth/mod.rs` already uses for the Claude Code and Codex inference wiring), both merging through the existing JSONC-safe path.

## Decided

Workspace settings will still beat user settings, and that is **accepted** — a repo pointing itself at a local gateway is a feature, not a leak. No `config --json` subcommand is needed.

## Also fix while in here

`configure`'s help text says it re-applies configuration "to Claude Code and Codex". It also writes VS Code, and has for a while.

## Verification

Record both keys in `managed.json` so they can be retracted. Confirm a machine with `gateway_url` set and `otel_endpoint` unset gets the `lightbridge.*` keys.

## AI Usage Declaration

AI-assisted. The mis-set URL was observed live during setup. A human owns intent, verification and consequences.