ci(tombstones): publish deprecation packages atomically with v0.3.0

Wire tombstones/pypi/ and tombstones/vscode/ into the existing release
machinery so v0.3.0 atomically ships:
  agentops-accelerator (PyPI) + AgentOpsAccelerator.agentops-skills (VSIX)
  agentops-toolkit (PyPI tombstone) + AgentOpsToolkit.agentops-skills (VSIX tombstone)

release.yml (5 new jobs + github-release update):
  build-pypi-tombstone           Resolves version from tombstones/pypi/
                                 pyproject.toml via tomllib, exposes as job
                                 output, builds dist, asserts artifact
                                 filenames with no hardcoded version pin.
  publish-tombstone-testpypi     Gated AFTER publish-testpypi.
  verify-tombstone-testpypi      Installs agentops-toolkit==<version> from
                                 TestPyPI, verifies pip-show Requires lists
                                 agentops-accelerator, and imports agentops
                                 to prove the redirect works end-to-end.
  publish-tombstone-pypi         Gated AFTER publish-pypi AND
                                 verify-tombstone-testpypi — prevents
                                 shipping a broken redirect to production.
  publish-tombstone-vsix         Gated AFTER publish-vsix. Substitutes the
                                 CHANGELOG date sentinel at publish time
                                 and tolerates the 'already exists' case.
  github-release                 Now lists tombstone artifacts as conditional
                                 downloads. The release notes job only blocks
                                 on main pypi+vsix — tombstone failures are
                                 recoverable in 0.3.1 and never block the
                                 canonical GitHub Release.

staging.yml (4 new jobs):
  Mirrors release.yml on the TestPyPI + pre-release VSIX side.
  publish-tombstone-vsix-prerelease has NO dependency on build-pypi-tombstone
  (separate channel) to avoid cross-channel coupling.

cut-release.yml:
  'Sync plugin versions' step now rewrites:
    tombstones/pypi/pyproject.toml      version field (regex)
    tombstones/vscode/package.json      version field (jq)
    tombstones/vscode/CHANGELOG.md      single entry's version heading,
                                        preserving YYYY-MM-DD sentinel for
                                        publish-time substitution
  Both Python rewrites use the heredoc-with-env-injection pattern and
  guard against silent no-op via 'raise SystemExit' if the regex doesn't
  match. 'git add' and PR body updated accordingly.

Required PyPI Trusted Publisher setup is now documented in the docstrings
of both release.yml and staging.yml — four total Trusted Publishers are
needed (agentops-accelerator and agentops-toolkit, on PyPI and TestPyPI).
VSCE_PAT must have 'Marketplace: Manage' scope on the AzDO account that
owns BOTH the AgentOpsAccelerator and AgentOpsToolkit publishers;
verify with: vsce ls-publishers -p $VSCE_PAT.

Reviewed by ai-starter-pack:critic (correctness lens) — all 3 CRITICAL,
4 IMPORTANT, and 1 SUGGESTION findings resolved before commit.

Author: Dongbumlee

.github/workflows/cut-release.yml

@@ -113,14 +113,53 @@ jobs:
             echo "$mp → $VERSION"
           done
 
+          # tombstones/vscode/package.json (legacy publisher VSIX tombstone)
+          jq --arg v "$VERSION" '.version = $v' \
+            tombstones/vscode/package.json > tombstones/vscode/package.json.tmp
+          mv tombstones/vscode/package.json.tmp tombstones/vscode/package.json
+          echo "tombstones/vscode/package.json → $VERSION"
+
+          # tombstones/pypi/pyproject.toml (legacy distribution PyPI tombstone)
+          VERSION="$VERSION" python - <<'PY'
+          import os, re, pathlib
+          v = os.environ["VERSION"]
+          p = pathlib.Path("tombstones/pypi/pyproject.toml")
+          t = p.read_text(encoding="utf-8")
+          new_t = re.sub(r'^version = "[^"]+"', f'version = "{v}"', t, count=1, flags=re.MULTILINE)
+          if new_t == t:
+              raise SystemExit("::error::tombstones/pypi/pyproject.toml version was not updated; check the regex anchor.")
+          p.write_text(new_t, encoding="utf-8")
+          PY
+          echo "tombstones/pypi/pyproject.toml → $VERSION"
+
+          # tombstones/vscode/CHANGELOG.md (rewrite single entry's version, preserve YYYY-MM-DD sentinel for publish-time substitution)
+          VERSION="$VERSION" python - <<'PY'
+          import os, re, pathlib
+          v = os.environ["VERSION"]
+          p = pathlib.Path("tombstones/vscode/CHANGELOG.md")
+          text = p.read_text(encoding="utf-8")
+          new_text = re.sub(
+              r"^## \[\d+\.\d+\.\d+\] - (?:YYYY-MM-DD|\d{4}-\d{2}-\d{2})",
+              f"## [{v}] - YYYY-MM-DD",
+              text, count=1, flags=re.MULTILINE,
+          )
+          if new_text == text:
+              raise SystemExit("::error::tombstones/vscode/CHANGELOG.md heading was not updated; check the regex anchor.")
+          p.write_text(new_text, encoding="utf-8")
+          PY
+          echo "tombstones/vscode/CHANGELOG.md → [$VERSION] (date sentinel preserved)"
+
       - name: Configure git
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
       - name: Commit and push
         run: |
-          git add CHANGELOG.md plugins/agentops/package.json plugins/agentops/plugin.json .github/plugin/marketplace.json .claude-plugin/marketplace.json
+          git add CHANGELOG.md plugins/agentops/package.json plugins/agentops/plugin.json \
+                  .github/plugin/marketplace.json .claude-plugin/marketplace.json \
+                  tombstones/vscode/package.json tombstones/pypi/pyproject.toml \
+                  tombstones/vscode/CHANGELOG.md
           git commit -m "chore: prepare release ${{ env.version }}"
           git push origin "release/v${{ env.version }}"
 
@@ -140,7 +179,9 @@ jobs:
           - Branch \`release/v${{ env.version }}\` created from \`develop\`
           - \`CHANGELOG.md\` updated: versioned section \`[${{ env.version }}]\` added
           - Plugin versions synced to \`${{ env.version }}\` (package.json, plugin.json, marketplace.json)
-          - Staging pipeline triggered automatically (build → TestPyPI + VSIX pre-release → verify)
+          - Tombstone versions synced to \`${{ env.version }}\` (tombstones/vscode/package.json, tombstones/pypi/pyproject.toml)
+          - \`tombstones/vscode/CHANGELOG.md\` heading rewritten to \`[${{ env.version }}]\` (date sentinel left for publish-time substitution)
+          - Staging pipeline triggered automatically (build → TestPyPI + VSIX pre-release → verify, plus tombstone TestPyPI + VSIX pre-release)
 
           ### Next steps
           1. Wait for the **Staging** pipeline to pass