feat: update GitHub Actions workflow to publish VS Code extension on merged PRs

[kasuken]

• Changed trigger from push to pull_request for the main branch.
• Added condition to ensure the job runs only on merged PRs.
• Updated npm install command from npm ci to npm install.
• Added step to upload VSIX artifact after packaging.
• Adjusted environment variable for VSCE token to use VSCE_PAT.

[Copilot]

Pull Request Overview

Updates the GitHub Actions workflow to publish the VS Code extension specifically when PRs are merged into the main branch, rather than on every push. This change provides better control over when the extension is published to the marketplace.

Key changes:

• Modified trigger from push events to merged pull request events
• Added VSIX artifact upload for better build traceability
• Updated environment variable configuration for VSCE authentication

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Changed from npm ci to npm install without justification. npm ci is preferred in CI environments as it performs faster, reliable, reproducible builds by installing directly from package-lock.json and fails if dependencies don't match the lock file.

Suggested change

	run: npm install
	run: npm ci

[Copilot]

[nitpick] The comment states that vsce reads the token from VSCE_PAT, but this behavior should be verified. The previous approach using --pat was explicit and clear. Consider keeping the explicit token passing for better clarity and reliability.

Suggested change

	# vsce reads token from VSCE_PAT; no need to pass --pat explicitly
	vsce publish
	# Explicitly pass the token using --pat for clarity and reliability
	vsce publish --pat $VSCE_PAT