[Story]: One command configures VS Code for the Lightbridge provider

## Story Statement

As a developer onboarding, I run `governance-auth configure` and my VS Code is correctly wired
to the Lightbridge provider — with no settings to paste by hand.

## Real Intent

`configure` already writes Claude Code, Codex and Copilot's OTLP keys. It holds both values the
extension needs and writes neither, so every developer hand-copies them and can get them wrong.

## Background and Context

Observed live: the base URL was entered as `…/v1`, and since the extension appends
`/v1/models/info` itself that produced `/v1/v1/models/info` and an empty picker.

`governanceAuthPath` matters more than it looks — the extension spawns without a shell, so a
desktop- or snap-launched VS Code often lacks `~/.local/bin` on `PATH`.

## Source of truth (links)

#233 · ADR-0012 (on-disk layout, absolute paths for shell-less spawns) · `otel.rs::configure_vscode`

## Acceptance Criteria

- `lightbridge.gatewayUrl` is written from `config.gateway_url` (**bare host**), and
`lightbridge.governanceAuthPath` from `std::env::current_exe()` (absolute).
- Both are gated on `gateway_url.is_some()` — **not** on `otel_endpoint`. A machine with a
gateway and no collector must still get them.
- Both are recorded in `managed.json` so they can be retracted.
- `configure`'s help text stops claiming it configures only "Claude Code and Codex".

## Out of Scope

Making these authoritative over workspace settings. Workspace precedence is **accepted** — a
repo pointing itself at a local gateway is a feature.

## Dependencies and Blockers

`configure_vscode` currently returns early with no OTLP endpoint, and its doc comment asserts
no inference setting exists for VS Code. That comment is now false and the gate must be split.

## Assumptions

The extension keeps appending `/v1/...` itself.

## Implementation Notes

Merge through the existing JSONC-safe path, which refuses a file it cannot round-trip rather
than stripping a developer's comments.

## Test Expectations

A fixture with `gateway_url` set and `otel_endpoint` unset receives the `lightbridge.*` keys.

## Verification evidence

To be filled at close.

## Human accountable owner

@stephane-segning

## AI Usage Declaration

AI-assisted. The mis-set URL was observed during live setup, not hypothesised.

## Human verification completed

- [ ] Reviewed