fix: install git extension fs-copyfile dependency

[cyphercodes]

Fixes #7806

Summary

• Hoist the VS Code git extension's @vscode/fs-copyfile runtime dependency into the shared lib/vscode/extensions install manifest used by code-server's npm postinstall.
• Generate the extensions shrinkwrap from a temporary patched manifest so the released npm package installs @vscode/fs-copyfile deterministically without mutating the VS Code submodule package files.
• Add script coverage for the dependency-hoisting helper.

Test plan

• ./ci/dev/lint-scripts.sh
• npm run test:scripts
• Temporary install/resolve smoke test: generated the extensions package lock with @vscode/fs-copyfile, installed production dependencies, and verified require.resolve("@vscode/fs-copyfile", { paths: ["<tmp>/git/dist"] }) resolves from extensions/node_modules.
• git diff --check HEAD~1..HEAD

[code-asher]

Awesome thank you for the PR!

I have a few worries, mainly that if the VS Code team ever adds new dependencies, or removes this one, or adds extensions with conflicting dependencies, we will probably not notice those until the npm module breaks again. And also since we are not referencing the extension's lockfile we might install a different version leading to subtly different behavior between the GitHub and npm releases.

There are a few ways we could resolve these issues, but what do you think about this strategy:

1. Patch lib/vscode/build/lib/extensions.ts to emit the external modules in the package.json's dependencies. I think probably the easiest way to do this is to return packagedDependencies from fromLocalEsbuild (in addition to the stream), and then in fromLocal we set data.dependencies = packagedDependencies.
2. Before we rsync the build, walk through each extension and generate a shrinkwrap for every extension with node_modules (or we could also do it as part of the same patch to extensions.ts, just would need to figure out the gulp syntax to do that).
3. Modify our postinstall to walk through each extension and install if necessary (I think the VS Code postinstall used to do this, if it still does we can skip this step).

So each extension with external dependencies will have their own shrinkwrap with its unique dependencies which should make the npm install match the GitHub release perfectly.

[cyphercodes]

Pushed a small CI follow-up for the script-unit failure: the new script/tests call jq, but the Alpine script-test job only installed bats and checkbashisms. The workflow now installs jq too.

Local verification:

• docker run --rm -v "$PWD:/work" -w /work alpine:3.17 sh -lc 'apk add bats checkbashisms jq >/dev/null && checkbashisms ./install.sh && ./ci/dev/test-scripts.sh' ✅
• git diff --check ✅