feat: publish on a tag — icon, gallery banner, release workflow (#4)

[zcsizmadia]

Everything in #4 that is not a token. The hawserhq publisher is registered and already in the manifest; what was missing was an icon and a way to actually ship.

The icon

Generated upstream in hawserhq/hawser by tools/genicons, at the 128px the Marketplace wants, from the same spiral and brand slate as every other raster asset — then copied here. Copied rather than hand-cut so it cannot drift from the brand source; the generator is deterministic, so it can be refreshed at any time without a visual diff nobody asked for. (Upstream PR: wslkit/skrog#222.)

release.yml

Runs on a v* tag, and on workflow_dispatch so a failed publish can be retried without cutting a new tag. Three deliberate choices:

The tag and package.json must agree. A Marketplace listing whose version names no tag in the repository cannot be traced back to source, so a mismatch fails the release rather than publishing.

The vsix is attached to the GitHub release before either publish. A failed Marketplace call then still leaves an installable artifact rather than nothing.

Each publish is skipped when its secret is absent — so a fork, and this repo until you add the tokens, gets a packaged, attached vsix instead of a red run.

That last one had a bug worth naming: I first wrote the secrets as step-level env with if: env.VSCE_PAT != ''. A step's if cannot see env defined in that same step, so both conditions would have evaluated wrongly. They are job-scoped now, and I verified the workflow parses and that the job env carries both keys.

Also

• Gallery banner in the brand slate (#2F3B45, dark theme)
• Keep-a-Changelog CHANGELOG.md with compare links
• CI and licence badges. The Marketplace badges are staged in an HTML comment with a note — they render "not found" until the first publish, and a README full of broken badges is worse than none.

Verified by packaging

npm run check && npm run build -- --production && vsce package
  -> 8 files, 17.78 KB, no vsce warnings

inside the vsix:
  icon.png    128 x 128
  publisher   hawserhq
  id          hawser
  version     0.1.0
  icon asset  extension/icon.png

Still yours

The two tokens, which I cannot create:

• VSCE_PAT — Azure DevOps PAT with Marketplace: Manage
• OVSX_PAT — from https://open-vsx.org

Add them as repo secrets and the publish steps light up; until then tagging produces a packaged vsix on the release and a green run. Then uncomment the two Marketplace badges.