feat(Search) Allow to disable the recursive search for configuration files

[Cyclodex]

Closes #13

Problem

getExtensionsJson() searched with the glob **/.vscode/extensions*.{json,jsonc}, so every subfolder of the workspace was scanned and all matches were merged into one flat config. That is the intended "subfolder support" from 1.1.2, but it also means a checked out sample project, a submodule or a vendored package can bring its own .vscode/extensions.json along and apply it to the whole workspace — which is what was reported in #13.

It also diverges from VS Code itself, which only resolves .vscode/extensions.json at the root of each workspace folder.

Two related limitations: node_modules was the only hardcoded exclusion, and because findFiles() was called with an explicit exclude string, the defaults derived from files.exclude / search.exclude no longer applied — so there was no way to narrow the search at all.

Solution

Two new settings. The current recursive search stays the default, so no existing setup changes behavior.

Setting	Type	Default	Effect
unwantedExtensions.recursiveSearch	boolean	true	false → only <workspaceFolder>/.vscode/extensions*.{json,jsonc} per root
unwantedExtensions.excludePattern	string	**/node_modules/**	Which folders to skip during the recursive search

Both are window scoped, since the search spans the whole workspace — a per-folder value would have been silently ignored in a multi-root setup.

Changes

• package.json: added a contributes.configuration block (the extension contributed no settings before)
• src/utils.ts: extracted the file lookup into findExtensionConfigFiles(). The recursive branch is the previous behavior with the exclude pattern now configurable; the non-recursive branch uses vscode.RelativePattern per workspace folder, so multi-root keeps working and the *.code-workspace handling is untouched
• The output channel now logs which search mode was used
• README.md: new "Limit the search to the workspace root" section incl. the settings table
• CHANGELOG.md: [Unreleased] entry

Verification

• tsc --noEmit passes
• the esbuild bundle builds

npm run lint and npm ci were already failing on main before this branch (eslint 9 expects a flat config while the repo has .eslintrc.json; the lockfile carries @types/vscode@1.107.0 while package.json pins 1.74.0). Both are untouched here.

Left out on purpose

• Version bump / release message — still at 1.2.4. The odd/even convention in VERSIONING.md makes 1.3.x vs 1.4.x a release-type decision, and RELEASE.md also asks for a releaseMessages.conf.ts entry.
• Deduping the merged unwantedRecommendations and logging which file each id came from — both would help diagnose exactly this class of surprise, but they are separate from the reported issue. Happy to add them here or in a follow-up.

---

Generated by Claude Code