We currently use a Personal Access Token (PAT) to publish the extension, we should swap to Microsoft Entra ID (AAD) as per the recommendation in the docs:
https://code.visualstudio.com/api/working-with-extensions/publishing-extension#secure-automated-publishing-to-visual-studio-marketplace 
Globally scoped PATs for publishing extensions will stop working in December 2026. We should set up the new authentication before that happens so we don't block our publishing.