We currently use a Personal Access Token (PAT) to publish the extension, we should swap to Microsoft Entra ID (AAD) as per the recommendation in the docs:
https://code.visualstudio.com/api/working-with-extensions/publishing-extension#secure-automated-publishing-to-visual-studio-marketplace 
Globally scoped PATs for publishing extensions will stop working in December 2026. We should set up the new authentication before that happens so we don't block our publishing. 
Let's ensure that this is managed via mana.