ci: build the workspace before packaging the VSIX

[oratis]

Summary

Third latent release.yml bug, uncovered once #247 got build-vscode past its version step.

✘ [ERROR] Could not resolve "@deepcode/core/skills"
✘ [ERROR] Could not resolve "@deepcode/core/tools"
✘ [ERROR] Could not resolve "@deepcode/core/dist/providers/deepseek.js"
    ../server/node_modules/@deepcode/core/package.json

build-vscode stamps core's VERSION into packages/core/src/index.ts, then goes straight to packaging. But the VSIX bundles the app-server, which bundles core, and core's package exports point at dist/ — which doesn't exist yet. Two consequences, not one: esbuild can't resolve the subpaths, and the version it just stamped would never have reached the bundle, since nothing compiled it.

pnpm release:check has always been pnpm build && … — which is why the gate passes locally and in validate. publish-cli already has the step at line 134. build-vscode was the one path that skipped it.

Progress on the pipeline

Attempt	validate	build-vscode	Cause
1	❌	—	No bubblewrap → bwrap ENOENT (#246)
2	✅	❌ step 7	npm version + workspace:* (#247)
3	✅	❌ step 8	This PR

Each fix moved the failure forward by one step, which is the expected shape when a pipeline has never run.

Test plan

• pnpm release:check passes locally with the same build-then-package ordering this adds
• Confirmed publish-cli already had pnpm build after its stamp step — this makes the two jobs consistent
• Verified by the next tag run

Release notes label

• release-notes:internal

Related

Follows #246 and #247. Blocks the v0.3.0 release (#245).

🤖 Generated with Claude Code