ci: migrate to pnpm/setup and vendor the Coder API client

[EhabY]

Closes #1119

Migrate to pnpm/setup

Replaces pnpm/action-setup, actions/setup-node, and the pnpm install --frozen-lockfile step in .github/actions/setup/action.yml with one pnpm/setup v3.1.1 step, pinned by SHA.

• Store cache. pnpm/setup restores with the keys [<prefix><lockfile hash>-, <prefix>], where the prefix is pnpm-cache-<os>-<arch>-<runtime hash>-. A dependency bump still falls back to the last store for the platform (see src/cache-restore/keys.ts).
• Cache writes. save-cache limits saves to main, matching the Chromium cache. PRs and release tags restore from main without writing their own entries.
• Frozen installs. require-lockfile: true runs the install with --frozen-lockfile and fails if no lockfile exists.
• Node version. runtime: node@22 keeps CI on Node 22. docs/TOOLING.md now lists this file among those to update when the minimum moves.
• Windows on ARM64. pnpm runtime set installs a win32-arm64 Node 22 build in the windows-11-arm job.

pnpm clean deletes installs, build output, and caches from an explicit list in scripts/clean.mjs. A prepackage script cleans and reinstalls before pnpm package. Webviews build into dist/webviews/<name>, so a webview left over from another branch otherwise ships in the package.

publish-extension.yaml still uses actions/setup-node directly, since it doesn't go through the shared setup action.

Vendor the Coder API client

The extension imports five files from coder/coder (api.ts, errors.ts, typesGenerated.ts, OneWayWebSocket.ts, and delay.ts), about 470 KB. The git dependency downloaded the whole repository, a 125 MB archive, on every cold install. On the Windows ARM64 job, that dominated the 2m14s install.

• pnpm sync:coder downloads the five files into vendor/coder/site at the release commit pinned in vendor/coder/sync.mjs (v2.37.1). The committed files match the previous dependency byte for byte.
• The Lint job runs pnpm sync:coder and fails on any diff, so hand edits or a bumped commit without a resync can't merge.
• coder is now link:vendor/coder, so every coder/site/src/... import resolves unchanged.
• Lint and format skip the vendored files, and .gitattributes marks them as generated.
• ESLint's import-x/external-module-folders includes vendor, so import-x/order keeps coder in the external group.
• With no git dependencies left, the setup action no longer rewrites GitHub SSH URLs to HTTPS.

pnpm's &path:/site option doesn't help here: it still downloads the full archive and installs the 75 dependencies in site/package.json.

[linear-code]

VSC-20