fix: use notification action buttons, fix path traversal check, and clean up

[mcanouil]

Summary

• Replace markdown command links in notification messages with VS Code action buttons via showMessageWithLogs, since VS Code notifications do not render markdown.
• Fix checkPathTraversal to split on path separators before checking for .. segments, preventing false positives on filenames containing that substring.
• Replace fs.existsSync with async fs.promises.access in findExtensionRoot and findAllExtensionRoots.
• Store latestVersion without @ prefix, fixing double-@ in the update-all command path.
• Use node:crypto import prefix per Node.js conventions.
• Update network tests to match new notification behaviour (action buttons instead of inline text).

Test plan

• Verify 332 tests pass (10 pre-existing failures in stale activate.test.js are unrelated).
• Verify lint passes cleanly.
• Verify core package tests (420) pass.
• Test notification messages show "Show Logs" action button.
• Test extension update commands produce correct repo@version format.