ci: keep a 2.x release from moving the latest tag

[kkdev92]

Makes the 2.x release path safe to use: an approval gate, its own dist-tag, and no "Latest" label, plus CI on this branch.

Why

README, SECURITY.md and CONTRIBUTING.md say 2.1.x still receives fixes from v2-maintenance, but the release workflow on this branch predates the current line:

• npm publish runs without --tag, so a 2.x patch would become npm's latest and what npm install vscode-ext-kit installs.
• The publish job has no environment, so nothing stands between pushing the tag and the registry. The current line's release goes through the npm-publish approval gate, whose tag policy (v*) admits 2.x tags as well.
• gh release create leaves "Latest" to GitHub.
• CI runs only for main, so pull requests into this branch are not checked.

What changed

• release.yml: the publish job uses the npm-publish environment; npm publish passes --tag maintenance-2x; gh release create passes --latest=false.
• ci.yml: runs on pushes and pull requests for v2-maintenance as well as main.

The dist-tag does not start with a digit or v, because npm rejects dist-tags that read as semver ranges (npm dist-tag); v2 would read as >=2.0.0 <3.0.0-0.

Verification

• Both workflow files parse, and the publish job resolves to environment: npm-publish with the two changed commands.
• The npm-publish environment's deployment policy is the tag pattern v*, so a v2.x.y tag can use it.
• This pull request runs CI on the 2.x code for the first time since the branch was cut; the result is below.
• Nothing is released by this change. It only affects the next 2.x tag.

🤖 Generated with Claude Code