ci(dependabot): pin @types/vscode to the engine floor

The VS Code typings must match the minimum engine version declared by the extension; any update moves the types ahead of the floor and breaks the compatibility test, so ignore all updates for that package. The setup-node pin assertion accepts v6 and v7 while the action update lands.

Author: Michael Gasperini

.github/dependabot.yml

@@ -49,4 +49,3 @@ updates:
       # The @types/vscode major tracks the engine floor declared in package.json;
       # advancing the types ahead of the floor breaks the compatibility tests.
       - dependency-name: "@types/vscode"
-        update-types: ["version-update:semver-major"]

test/metadata.test.js

@@ -221,7 +221,7 @@ test('CI validates securely across supported platforms and editor versions', ()
   assert.equal(workflow.match(/if: github\.event_name != 'schedule'/g)?.length, 2);
   assert.match(workflow, /permissions:\s+contents: read/);
   assert.match(workflow, /actions\/checkout@[0-9a-f]{40} # v7/);
-  assert.match(workflow, /actions\/setup-node@[0-9a-f]{40} # v6/);
+  assert.match(workflow, /actions\/setup-node@[0-9a-f]{40} # v[67]/);
   assert.doesNotMatch(workflow, /uses: actions\/(?:checkout|setup-node)@v\d+/);
 });