ci: publish with Entra ID OIDC instead of a Personal Access Token

## Background

Publishing v0.2.0 failed because `VSCE_PAT` had expired, and this is not a problem that stays fixable by rotating the token. The VS Code publishing documentation states that **global Personal Access Tokens in Azure DevOps are retired on December 1, 2026**. After that date the current `publish.yml` stops working entirely.

The documented replacement is Microsoft Entra ID authentication with workload identity federation, so GitHub Actions exchanges its OIDC token for a short-lived credential and no long-lived secret is stored in the repository.

## Current state

`.github/workflows/publish.yml` runs on `release: published` and calls `npm run publish` (`vsce publish`) with `VSCE_PAT` from repository secrets.

The pinned `@vscode/vsce` is 3.9.2, which already accepts `--azure-credential` ("Use Microsoft Entra ID for authentication"), so no tooling upgrade is needed.

## Plan

### Manual setup (cannot be done from this repository)

1. Create a **user-assigned managed identity** in an Azure subscription. Use a managed identity, not an app registration — app registrations are reported to fail at publish time even though `vsce verify-pat` succeeds.
2. Add a GitHub Actions **federated credential** to that identity, with entity type **Environment** (not Branch or Tag), pointing at `akiomik/vscode-gaming` and an environment such as `marketplace-publish`.
3. Store `AZURE_CLIENT_ID` and `AZURE_TENANT_ID` as repository secrets. Neither is a secret value in the sense a PAT is, but the workflow reads them from there.
4. Register the identity with Azure DevOps once, and take the `id` from the response — that is the identifier the Marketplace recognizes:

```sh
az rest -u https://app.vssps.visualstudio.com/_apis/profile/profiles/me \
--resource 499b84ac-1321-427f-aa17-267ca6975798
```

5. Add that identity as a **Contributor** on the `omi` publisher at .

### Workflow changes

- Grant `id-token: write` (and `contents: read`) permissions to the publish job.
- Set `environment: marketplace-publish` so the federated credential matches.
- Add an `azure/login` step with `client-id`, `tenant-id` and `allow-no-subscriptions: true`.
- Pass `--azure-credential` to `vsce publish` and drop the `VSCE_PAT` environment variable.
- Delete the `VSCE_PAT` repository secret once a release has published successfully.

## Verification

There is no way to dry-run a publish against the real Marketplace, so the first real proof is the next release. To keep that from being the only signal, the identity can be checked ahead of time with `vsce verify-pat --azure-credential` in a manually dispatched job. Note that `verify-pat` succeeding does not by itself prove `publish` will succeed — that gap is exactly the app-registration failure mode above — so it is a smoke test, not a guarantee.

## Notes

- This does not remove the dependency on a Microsoft-side account; it moves it from a token that expires to an identity that does not.
- An Azure subscription and an Entra tenant are required. The free tier is enough.

## References

-
-
-