- `pnpm bump` (bumpp) bumps packages/vscode/package.json and commits
  `chore(vscode): release vX.Y.Z`; no tag, no push — the release workflow
  tags the commit it actually published from.
- release.yml gains a final job that, after every target published, pushes
  the `vX.Y.Z` tag (idempotent) and creates the GitHub Release through
  changelogithub with notes from the conventional commits since the previous
  tag and the six VSIX files attached. Skipped on dry runs.
- Document the flow in CONTRIBUTING.md and point to it from AGENTS.md.

… bump

The first release lands through `pnpm bump` so main keeps an explicit
`v0.1.0` bump commit.

Root scripts are pnpm -r fan-outs and must not reach into a package
(AGENTS.md); bumpp and its config now live in packages/vscode and the root
`bump` script is `pnpm -r run bump`. Verified the interactive prompt still
gets a TTY through the fan-out for a single package.

- preflight job fails a non-dry dispatch from any ref but main (gh workflow
  run --ref accepts branches and tags); dry runs stay allowed anywhere.
- The tag step is idempotent only when the existing tag points at this
  commit; a tag on another commit means the version was never bumped, and
  the run fails instead of attaching mismatched VSIX assets.
- bumpp ^11.1.0 (engines >=20.19) instead of 12 (^22.18 || ^24.11 || >=26),
  matching the root Node floor of >=22.12.

All packages share one version (as in rspack-contrib/storybook-rsbuild), so
bumpp lives at the root with files: packages/*/package.json and the VS Code
manifest as the reference version. AGENTS.md records this as the one
repo-level exception to the fan-out rule: no per-package script can bump
several packages to the same version in one commit.

bumpp derives currentVersion from the globbed files, so reading packages/vscode/package.json to seed it was redundant and hard-coded a reference package the lockstep policy says does not exist. fetch-tags is dead config under fetch-depth: 0 (checkout takes the all-history refspec and never reads it), the event_name guard was tautological against a dispatch-only trigger, and the Report step, the ls -la and the banner comment were noise. Docs: CONTRIBUTING is the single place the release procedure is described.