Migrate publish workflow to OIDC + Release-triggered

[noppej]

• Trigger on GitHub Release publication instead of merged PR
• Authenticate to VS Marketplace via Microsoft Entra federated
  credentials (no PAT); OVSX still uses a token, now scoped to a new
  marketplace GitHub Environment with required reviewers
• Split VSCE and OVSX into independent jobs so a transient OVSX
  failure no longer marks a successful VSCE publish as failed
• Add PUBLISH.md documenting the release procedure, architecture,
  and how to recreate the pipeline from scratch
• README points to PUBLISH.md for maintainers