Correct SLSA workflow/v1 provenance for Stable and PreRelease VSIX releases

The versioned Stable and PreRelease VSIX pipelines currently generate SLSA Provenance v1 using GitHub's `workflow/v1` build type from a top-level `pull_request` event. That event is not supported by the declared build type, so cryptographically valid attestations do not establish the intended Build Level 3 semantics.

Replace the post-tag release path with a protected, channel-aware tag-push producer. Keep reviewed release promotion and release-please tag creation, consolidate package and attestation work under one reusable trusted-builder workflow with separate least-privilege jobs, and preserve existing SBOM, VEX, release verification, and Marketplace controls.

This Bug incorporates the still-relevant verification-gate requirement from #2229 and supersedes its narrower workflow-specific scope.

## Acceptance Criteria

- [ ] Stable and PreRelease release tags invoke one top-level `push` producer using supported `workflow/v1` semantics.
- [ ] The tag-push run is the sole post-tag owner of VSIX packaging, attestation, verification, GitHub Release publication, and milestone closeout.
- [ ] Packaging and attestation run in one reusable trusted-builder workflow with separate GitHub-hosted jobs and least-privilege permissions.
- [ ] Release verification authenticates the exact VSIX and fails closed on signer revision, source digest and tag ref, predicate and build type, event, builder, runner, external parameters, invocation, or subject mismatch.
- [ ] Stable and PreRelease behavior preserves dependency and per-package SBOMs, Sigstore and in-toto evidence, Stable VEX and dependency-diff behavior, release notes, and exact asset reconciliation.
- [ ] Marketplace publication remains separate and preserves protected OIDC, exact tag dereference, dual provenance verification, and checked artifact transfer.
- [ ] Contract and verifier tests cover the new topology, bounded draft discovery, successful verification, and every material failure class before publication.
- [ ] Operational documentation explains tag governance, release ownership, recovery, rollback, verification policy, and the limit on any Build Level 3 claim.
- [ ] One future Stable and one future PreRelease release provide exact-byte, signer, source, predicate, event, runner, parameter, invocation, and release-identity evidence.
- [ ] No SLSA v1.0 Build Level 3 claim is made until tag-governance evidence, dual-channel runtime evidence, platform assurance, and qualified human review are complete.

## Related

- Supersedes: #2229
- Affected workflows: Stable and PreRelease VSIX release pipelines