fix(packaging): keep bundled node_modules/npm in win32-x64 .vsix + add CI verify

User reported v0.1.1 .vsix with bundled Node + npm.cmd STILL failed
when enabling search mode:

  Error: Cannot find module
    '...\node-runtime\node_modules\npm\bin\npm-cli.js'
    MODULE_NOT_FOUND

Root cause: `.vscodeignore` had `**/node_modules/**` which matches
EVERY `node_modules/` at any depth — including the bundled
`extension/bin/node-runtime/node_modules/npm/` that we explicitly
extracted from the Node Windows zip during CI. So vsce dropped the
entire npm package while keeping node.exe + npm.cmd, leaving a
"bundled Node" install that couldn't actually run npm.

This is the third Windows fix attempt for search-mode. Each
previous one was structurally correct but a layer-below bug
silently sabotaged it. To stop the cycle, this commit also adds a
CI verification step that fails the build if the required files
aren't physically inside the .vsix.

Files:

- extension/.vscodeignore — replaced `**/node_modules/**` (matches
  any depth) with `node_modules/**` (only the top-level
  extension/node_modules). The bundled
  bin/node-runtime/node_modules/ now ships intact.

- .github/workflows/publish-extension.yml — new "Verify bundled
  Node runtime" step on win32-x64. Lists the .vsix via `unzip -l`
  and asserts each of these is present:
    extension/bin/axme-code.exe
    extension/bin/node-runtime/node.exe
    extension/bin/node-runtime/npm.cmd
    extension/bin/node-runtime/node_modules/npm/bin/npm-cli.js
    extension/bin/node-runtime/node_modules/npm/bin/npm-prefix.js
  Any missing entry fails the build with a clear ::error:: marker.
  If a future .vscodeignore tweak or vsce update silently drops one
  of these, CI will catch it BEFORE we ship a broken .vsix to
  users. Caught the original regression manually on 2026-05-19 —
  never again.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: George-iam

.github/workflows/publish-extension.yml

@@ -204,6 +204,37 @@ jobs:
         working-directory: extension
         run: npx vsce package --target ${{ matrix.target }} --no-dependencies -o ../axme-code-${{ matrix.target }}.vsix
 
+      - name: Verify bundled Node runtime is inside the win32-x64 .vsix
+        # A .vsix is just a zip. List its contents and assert that the
+        # files search-mode needs at runtime are actually present.
+        # Without this check, an over-broad .vscodeignore pattern (e.g.
+        # the historical `**/node_modules/**`) silently drops the
+        # bundled npm package from the package, and we ship a build
+        # that boots fine on Cursor but explodes the moment a user
+        # enables semantic search. We caught this once on 2026-05-19;
+        # never again — this step fails CI if the bundle regresses.
+        if: matrix.target == 'win32-x64'
+        shell: bash
+        run: |
+          set -euo pipefail
+          VSIX="axme-code-${{ matrix.target }}.vsix"
+          REQUIRED=(
+            "extension/bin/axme-code.exe"
+            "extension/bin/node-runtime/node.exe"
+            "extension/bin/node-runtime/npm.cmd"
+            "extension/bin/node-runtime/node_modules/npm/bin/npm-cli.js"
+            "extension/bin/node-runtime/node_modules/npm/bin/npm-prefix.js"
+          )
+          MANIFEST=$(unzip -l "$VSIX")
+          for path in "${REQUIRED[@]}"; do
+            if ! echo "$MANIFEST" | grep -qE "  ${path}\$"; then
+              echo "::error::Missing from $VSIX: $path"
+              echo "$MANIFEST" | head -40
+              exit 1
+            fi
+          done
+          echo "OK — all required bundled-Node files are inside $VSIX."
+
       - uses: actions/upload-artifact@v4
         with:
           name: axme-code-${{ matrix.target }}

extension/.vscodeignore

@@ -9,7 +9,13 @@ out-test/**
 **/.eslintrc*
 **/.gitignore
 **/build.mjs
-**/node_modules/**
+# Only exclude extension/node_modules — the bundled Windows Node
+# runtime ships its own `bin/node-runtime/node_modules/npm/` which
+# IS required at runtime (search-mode `npm install`). The previous
+# `**/node_modules/**` pattern silently dropped the bundled npm
+# from the .vsix, so on Windows the npm-cli.js spawn failed with
+# MODULE_NOT_FOUND on every search-mode enable attempt.
+node_modules/**
 .github/**
 .git/**
 **/*.vsix