Harden the public A2AC Workspace release

[Phil-Hills]

Summary

• separate the public IDE client from private runtime topology and deployment state
• migrate runtime API keys from settings into VS Code SecretStorage
• remove user-input shell interpolation from primary task, project, search, and local-chat workflows
• add accurate product-boundary, security, privacy, contribution, and installation documentation
• add CI verification and release version 2.4.2

Why

The public repository is useful for GCP and customer review, but it must be a self-contained client repository rather than a mirror of production configuration. The previous release embedded deployment-specific service URLs, a personal filesystem fallback, a plaintext API-key setting, and claims that exceeded the published code.

Verification

• JavaScript syntax checks for extension.js, context-bridge.js, and a2ac-mcp-server.js
• Python byte-compilation for all helper scripts
• package manifest parse and command-registration comparison
• current-tree and Git-history sensitive-pattern scans
• successful VSIX package build: a2ac-workspace 2.4.2, 20 files

GitHub private vulnerability reporting, secret scanning, push protection, and Dependabot security updates were also enabled for the repository.