Awesome thank you for the PR!

I have a few worries, mainly that if the VS Code team ever adds new dependencies, or removes this one, or adds extensions with conflicting dependencies, we will probably not notice those until the npm module breaks again. And also since we are not referencing the extension's lockfile we might install a different version leading to subtly different behavior between the GitHub and npm releases.

There are a few ways we could resolve these issues, but what do you think about this strategy:

1. Patch lib/vscode/build/lib/extensions.ts to emit the external modules in the package.json's dependencies. I think probably the easiest way to do this is to return packagedDependencies from fromLocalEsbuild (in addition to the stream), and then in fromLocal we set data.dependencies = packagedDependencies.
2. Before we rsync the build, walk through each extension and generate a shrinkwrap for every extension with node_modules (or we could also do it as part of the same patch to extensions.ts, just would need to figure out the gulp syntax to do that).
3. Modify our postinstall to walk through each extension and install if necessary (I think the VS Code postinstall used to do this, if it still does we can skip this step).

So each extension with external dependencies will have their own shrinkwrap with its unique dependencies which should make the npm install match the GitHub release perfectly.