feat: support VS Code variables in path settings + fix age-plugin decryption via locale

[nightvisi0n]

Summary

Two robustness fixes for real-world setups (mise-managed binaries, hardware-backed age keys):

1. VS Code variable substitution in path-valued settings.
2. UTF-8 locale fallback for the spawned sops process, which unbreaks age plugins (e.g. age-plugin-yubikey).

Motivation

• Pointing sops.binPath at a mise shim with "${workspaceFolder}/.vscode/mise-tools/sops" failed with spawnSync ${workspaceFolder}/.vscode/mise-tools/sops ENOENT as the extension passed the literal ${workspaceFolder} to spawnSync without substitution. VS Code does not auto-expand ${...} in arbitrary extension settings.
• Decryption through age-plugin-yubikey might have failed for some users with age: yubikey plugin: failed to read line: EOF only when the editor was launched from the GUI (Finder/Dock), while a manual sops -d in a terminal worked with the same binary. Root cause: the plugin exits on startup when no locale is set, and GUI-launched editors inherit no LANG. A terminal does, hence the discrepancy.

Changes

• Variable substitution for sops.binPath, sops.configPath, sops.defaults.gcpCredentialsPath, and sops.defaults.ageKeyFile. Supported: ${workspaceFolder}, ${workspaceFolder:Name} (multi-root), ${workspaceFolderBasename}, ${fileWorkspaceFolder}, ${userHome}, ${env:VAR}, ${pathSeparator}/${/}, and a leading ~. Resolution is resource-aware (uses the workspace folder of the file being processed) and uses uri.fsPath for correct OS paths. Existing relative-path handling is preserved; the .sopsrc absolute-path check now uses path.isAbsolute (also fixes a latent Windows case).
• Locale fallback: when LANG/LC_ALL/LC_CTYPE are all unset, the sops subprocess is given LANG=en_US.UTF-8. An explicitly configured locale is always respected.

Testing

• New unit tests for the pure helpers: applyVariableSubstitution (workspace/named/basename/env/~/edge cases) and localeEnvFallback (default applied, empty LANG treated as unset, explicit LANG/LC_ALL/LC_CTYPE respected).
• npm run compile and npm run lint pass.
• Manually verified end-to-end: ${workspaceFolder} binPath resolves and decrypts via YubiKey when launched from the GUI.

Compatibility

• No config migration. Plain paths and existing relative-path behavior are unchanged; substitution only activates on ${...}/~. The locale fallback is a no-op when a locale is already set.