vscode: refresh bun.lock to pull patched transitive deps

[santosr2]

What and why

Regenerates vscode/bun.lock so stale transitive resolutions float to their patched in-range versions, clearing all 12 bun audit findings (8 high, 4 moderate):

Package	Was	Now	Advisories
undici	7.28.0	7.29.0	GHSA-4cwx-7wf7-3272, GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm
fast-uri	3.1.3	3.1.6	GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx
brace-expansion	2.1.2	2.1.4	GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895
js-yaml	4.3.0	4.3.2	GHSA-5p4m-2wfm-xmqj

All affected packages are transitive devDependencies (via @vscode/vsce, minimatch, mocha, secretlint); none ship in the extension bundle. package.json ranges are untouched since every patched version was already allowed by the existing semver ranges.

Why: bun audit flagged 12 vulnerabilities in the lockfile. The pins were simply stale; no range changes were needed.

How to test

cd vscode
bun install
bun audit        # no vulnerabilities found
bun run compile  # passes
bun run lint     # passes

Notes for reviewers

A plain bun update was deliberately avoided: it bumps @types/vscode to ^1.134.0, which would exceed the engines.vscode minimum (^1.110.0) and break vsce package. Extension tests could not run locally (headless machine missing libatk-1.0.so.0); the vscode.yml workflow covers them.

Checklist

• I have read the CONTRIBUTING guidelines
• My code follows the project's code style
• I have added tests that prove my fix/feature works (lockfile-only change, no code)
• All checks pass (mise run check runs fmt, vet, lint, and test)
• I have updated documentation as needed (not applicable)
• My commits follow Conventional Commits

---

🤖 Generated with Claude Code