fix: isolate code-server startup from extension provisioning

[MioYuuIH]

Summary

• install platform-default extensions into code-server's immutable system extension root during image build while preserving the persistent user extension directory
• remove runtime extension installation from the readiness path, isolate the public PORT from code-server, and supervise both child processes cleanly
• disable Hub termination after consecutive user spawn failures, set HTTP readiness to 60 seconds, and retain the 300-second pod start budget
• add focused launcher, chart-default, and CI regression coverage

Verification

• normal Code image build, including the final RUN --network=none system-extension verification layer
• finished image startup with Docker networking disabled, seven system defaults, persistent user extension preservation, custom public/internal ports, and TERM exit 143
• pytest -q (176 passed)
• CI-equivalent Python selection (177 passed)
• focused runtime extension-model and service-lifecycle shell suites
• Ruff check/format, basedpyright, ShellCheck, yamllint, Helm lint/render, Dockerfile build check, and git diff --check

Compatibility

Existing user-installed extension copies and metadata remain untouched. When a user extension and a system extension share an ID, native VS Code precedence applies.