chore(deps): bump @types/node from 26.2.0 to 26.4.0 in /packages/vscode - #2202

* ci(nix): refresh the vscode npmDepsHash automatically

`flake.nix` pins `npmDepsHash` over packages/vscode/package-lock.json,
because buildNpmPackage hashes the vendored dependency tree. Dependabot
updates the lockfile and has no way to know a Nix expression hashes it,
so every npm bump to that package landed red on a fixed-output mismatch
and sat there until somebody recomputed the hash by hand. That is #2109,
#2202 and #2243, and both currently open dependabot PRs (#2269, #2272).
`build` requires that job, so none of them could ever merge unattended.

There was no tooling for it: nothing in .github, scripts or the justfile
mentioned prefetch-npm-deps. The repair was folklore.

Adds a workflow that recomputes the hash on any pull request touching the
lockfile and commits it to the branch. It is deliberately separate from
the `VS Code Extension (Nix)` job: that job verifies, this one repairs,
and a verifier that silently rewrites what it is checking is worse than
one that fails.

It cannot push to a fork, so it always writes the correct value to the
job summary as well. A contributor whose PR it cannot fix still gets the
exact line to change instead of a bare Nix hash mismatch.

The push is self-terminating: it only commits when the computed hash
differs, so the run it triggers finds a match and stops.

Also adds `just nix-refresh-vscode-hash` for the same repair locally, and
documents both in CONTRIBUTING.

Verified rather than assumed: the recipe reports "already correct" on
main, and when flake.nix is corrupted it repairs the value and restores
the file byte-identically.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012nNGPA44Dt32NyxWem26xr

* fix(nix): keep prefetch stderr, and drop the GNU-only sed

Copilot review on #2284, both valid.

Discarding prefetch-npm-deps stderr meant any real failure — network,
auth, a lockfile it cannot parse — surfaced only as "produced no hash",
which says nothing about why. That is the same silent-failure shape this
whole change exists to remove, one level up. stderr is captured and
printed when no hash comes back.

The justfile used `sed -i` with no suffix, which is GNU-only: BSD and
macOS sed take a mandatory argument there, and no single spelling works
on both. Replaced with write-to-temp and move. The workflow's own sed
runs on ubuntu-latest so it was never affected, but the recipe is for
contributors, some of whom are on macOS.

Re-verified both directions after the change: the recipe repairs a
corrupted hash and restores flake.nix byte-identically, and reports
"already correct" when it is.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012nNGPA44Dt32NyxWem26xr

* fix(ci): report the npmDepsHash instead of pushing it

CodeQL on #2284: unsafe checkout of untrusted code in a non-privileged
context. The finding is correct. The job held `contents: write`, checked
out pull-request head code, and ran a tool over a lockfile the pull
request controls. That is the shape of the problem, regardless of whether
this particular tool is exploitable.

Automating the commit safely needs the two-stage `workflow_run` split,
where the privileged half never checks out untrusted code. That is a lot
of machinery for a one-line repair, so the job now reports instead: it
fails with the exact value to set, in both the error annotation and the
job summary, and `just nix-refresh-vscode-hash` applies it in one
command.

That keeps what actually made this recur — nobody knew the command, and
nothing in the repo mentioned prefetch-npm-deps — while dropping the
write permission and the head-ref checkout entirely. The job now needs no
permissions beyond the read-only default and takes the ordinary
merge-commit checkout.

Worth revisiting with the workflow_run split if reporting proves to be a
nuisance rather than a fix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012nNGPA44Dt32NyxWem26xr

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>