release: harden security and publish v0.1.5

[TheStreamCode]

Summary

• remediate the current high-severity development dependency advisories
• add behavioral regression coverage for Workspace Trust and user-level-only launch commands
• add a weekly locked-dependency security audit and expand required checks
• refresh the GitHub/Marketplace-facing README with a real Extension Host capture
• add a reproducible 1280x640 social preview
• prepare v0.1.5 and publish VSIX SHA-256 checksum assets
• move detailed contributor and release operations into CONTRIBUTING.md

Validation

• npm ci --ignore-scripts
• npm run check — 26/26 tests plus stable Extension Host
• npm run check:security — 0 vulnerabilities
• VS Code 1.103.0 Extension Host smoke test
• npm run package — 16 files, 95,514-byte VSIX
• isolated VSIX install smoke test — mikesoft.vscode-kimi-code-cli-launcher@0.1.5
• git diff --check

Release boundary

The tag and GitHub release will be created after this pull request lands on main. Marketplace and Open VSX publishing remain separate maintainer-controlled operations because publisher tokens are intentionally unavailable to automation.