[soulbah]

Release immutability is now enabled on this repository (GET /repos/rootform-dev/editors/immutable-releases returns enabled: true), so a published release, its VSIX and SHA256SUMS, and its version tag can no longer change.

The release workflow now relies on that record:

• github-release creates the release only when no published release exists for the tag (gh still uploads to a draft and publishes last), so re-running failed jobs resumes instead of failing on an existing release.
• It then requires GitHub to report the release published and immutable, holding exactly the packaged files (asset digests equal the local sha256sum of the VSIX and SHA256SUMS), with a short wait for the lock.
• Open VSX and the Visual Studio Marketplace run after that check, so a store never receives a VSIX that the immutable GitHub release does not describe.

docs/releasing.md describes the guarantee and how to resume.

Validation: actionlint .github/workflows/release.yml, bun run check:format; a local stub run of the digest comparison reports match for identical files and mismatch when an asset is missing. verify runs in CI. No tag or release is created by this PR.