build: preserve GLIBC 2.28 compatibility

[Harald Kirschner (digitarald)]

Summary

• pin @github/copilot-sdk to 0.2.0 in the CLI and VS Code extension
• override @github/copilot to 1.0.10 in both dependency trees
• remove the transitive pvrecorder native binary that requires GLIBC newer than 2.28

Why

Azure CI build 476515 failed the native module compatibility check because Copilot 1.0.45 bundled @picovoice/pvrecorder-node, whose Linux x64 binary depends on GLIBC > 2.28. The permissive SDK range allowed the root lockfile to drift to SDK 0.2.2 and Copilot 1.0.45.

Validation

• clean npm ci in the root and vscode-extension
• verified both trees resolve SDK 0.2.0 and Copilot 1.0.10
• verified neither tree contains pvrecorder or pv_recorder.node
• npm run build
• npm run typecheck
• cd vscode-extension && node esbuild.mjs && npx tsc --noEmit
• Prettier and git diff --check

🤖 Posted by GitHub Copilot on Harald's behalf.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Regenerate both lockfiles so their root metadata records the package overrides and matches package.json.

Review effort: Lite
Findings: None

What changed in this PR

Pins Copilot dependencies to preserve GLIBC 2.28 compatibility and removes the incompatible native module.

Changes:

• Pins @github/copilot-sdk to 0.2.0.
• Overrides @github/copilot to 1.0.10.
• Updates CLI and extension dependency lockfiles.

File	Summary
vscode-extension/​package.json	Pins compatible Copilot dependencies.
vscode-extension/​package-lock.json	Locks the compatible dependency tree; root override metadata is missing.
package.json	Pins compatible Copilot dependencies.
package-lock.json	Locks the compatible dependency tree; root override metadata is missing.

Files not reviewed (1)

• vscode-extension/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Harald Kirschner (digitarald)]

Rechecked with npm 11.13.0: both lockfiles were regenerated after the overrides entries were added. npm lockfile v3 does not serialize the root overrides object into packages[""]; the override is represented by the resolved dependency tree instead. Both root and extension npm ci --dry-run checks succeed and resolve @github/copilot to 1.0.10. Manually adding unsupported lockfile metadata would be noncanonical and removed on regeneration, so no code change is needed.

🤖 Posted by GitHub Copilot on Harald's behalf.