feat(#2103): drive VS Code through the Embeddable Orchestration System (ADR-1239)

VS Code is a net-new EoS runtime that — unlike every prior migration — is NOT
CLI-installed (Marketplace/VSIX extension). It has zero runtime==='vscode'
branches in bin/install.js and stays that way (regression-guarded); it is driven
entirely through the negotiated imperative Host-Integration adapter.

Registry + validator (the hard part):
- capabilities/vscode/capability.json (role:runtime): full hostIntegration block
  (imperative / palette / active vscode.lm model / engine hook bus /
  sandboxed-storage / mcp transport / sandboxed-web runtime; dispatch nested,
  maxDepth 5 per VS Code's documented subagent depth).
- capability-validator.cjs extended so a role:runtime capability can legitimately
  declare "extension-distributed, no config directory": new configHome.kind:'none'
  + installSurface:'none' (+ GATE-A pairing + the parity maps), with localConfigDir
  and configHome.name made conditional on kind!=='none'. All 18 runtimes still
  validate; getDirName returns a distinct sentinel (not '.claude') for a no-config
  runtime.
- The add-a-registry-runtime tax: NON_INSTALLABLE_RUNTIMES exemption in the
  runtime-flags drift guard, vscode added to global-config-home SPECIAL_CASED,
  EXPECTED_PROFILES.vscode='ide', and the config-adapter/derivation/pin-count
  guards updated. No golden-install fixture, model-catalog, or CONFIGURATION rows
  (vscode never enters allRuntimes).

Dispatch + extension surface:
- Fixed vscode/extension.js's createHub()-no-args bug (every dispatch was
  UnknownCommand, masked by a vacuous reachability test) — now reuses the shared
  dispatchGsdCommand subprocess-shim (Node/desktop); the reachability test is
  tightened to assert real dispatch.
- Promoted the #1933 host binding to a shipped vscode/host-binding.js; activate()
  now composes the model/hookBus/stateIO seams through it. Corrected the model
  seam to VS Code's real API (vscode.lm.selectChatModels() -> model.sendRequest();
  vscode.lm.sendRequest does not exist) so the binding actually composes on real
  desktop VS Code instead of throwing.
- New vscode/browser.js Web Extension entry with ZERO Node APIs (the engine's
  config/capability loading is Node-bound, so the web entry registers the surface
  and directs full dispatch to the native MCP server — honestly documented).
- UPGRADE 1: GSD skills as native Language Model Tools (contributes.languageModelTools
  + vscode.lm.registerTool), invoke() dispatching through the hub.
- UPGRADE 2: native subagent dispatch wired onto #runSubagent /
  chat.subagents.allowInvocationsFromSubagents (fail-soft on API availability,
  maxDepth 5 enforced).
- vscode/package.json: browser entry, engines.vscode ^1.105, chatParticipants +
  languageModelTools contributions; fixed a stale activationPoints->activationEvents
  manifest key. Added "vscode" to the package files array.

Docs (## vscode matrix section) + changeset (Added).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/runtime-flags.test.cjs

@@ -17,6 +17,14 @@ const EXPECTED_FLAGS = [
   'isCodebuddy', 'isCline', 'isKimi', 'isZcode', 'isPi',
 ];
 
+// #2103: registry runtimes that are NEVER CLI-installed via bin/install.js
+// (Marketplace/VSIX-distributed, no --<rt> flag, not in allRuntimes) — these
+// have no runtimeFlags entry by design, not by drift. vscode is the first
+// (and, today, only) member: it enters `registry.runtimes` (role:runtime, for
+// validator/host-integration coverage) but never enters bin/install.js's
+// allRuntimes, so it must not be required to have an isVscode flag here.
+const NON_INSTALLABLE_RUNTIMES = new Set(['vscode']);
+
 test('runtimeFlags: every known non-claude runtime sets exactly its own flag true', () => {
   const ids = EXPECTED_FLAGS.map((f) => f.slice(2).toLowerCase());
   for (const id of ids) {
@@ -44,11 +52,27 @@ test('runtimeFlags: all 16 flags present + boolean + the object is frozen', () =
   assert.ok(Object.isFrozen(flags), 'flags object must be frozen');
 });
 
-test('runtimeFlags drift guard: covers every registry runtime except claude', () => {
+test('runtimeFlags drift guard: covers every registry runtime except claude and the non-installable set', () => {
   // Adding a registry runtime that is not claude must get a flag or be added to
   // RUNTIME_FLAG_IDS — pin the set so a new runtime forces a deliberate update.
-  const registryNonClaude = Object.keys(registry.runtimes).filter((r) => r !== 'claude').sort();
+  // NON_INSTALLABLE_RUNTIMES (#2103) is filtered out first: a runtime that is
+  // never CLI-installed (e.g. vscode — Marketplace/VSIX only) has no --<rt>
+  // flag by design and must not trip this guard.
+  const registryNonClaude = Object.keys(registry.runtimes)
+    .filter((r) => r !== 'claude' && !NON_INSTALLABLE_RUNTIMES.has(r))
+    .sort();
   const flagIds = EXPECTED_FLAGS.map((f) => f.slice(2).toLowerCase()).sort();
   const missing = registryNonClaude.filter((r) => !flagIds.includes(r));
   assert.deepEqual(missing, [], `registry runtimes missing a runtimeFlags entry: ${missing.join(', ')} — add to RUNTIME_FLAG_IDS`);
 });
+
+test('#2103: vscode is registered but intentionally excluded from runtimeFlags (Marketplace-distributed, never CLI-installed)', () => {
+  assert.ok(registry.runtimes.vscode, 'vscode must be present in the registry (role:runtime)');
+  assert.ok(NON_INSTALLABLE_RUNTIMES.has('vscode'));
+  const flags = runtimeFlags('vscode');
+  for (const f of EXPECTED_FLAGS) {
+    assert.strictEqual(flags[f], false, `runtime 'vscode': ${f} must be false (no isVscode flag exists)`);
+  }
+  assert.deepStrictEqual(Object.keys(flags).sort(), [...EXPECTED_FLAGS].sort(),
+    'runtimeFlags(\'vscode\') must NOT introduce a new isVscode key — still exactly the 16 flags');
+});