ci: move forbidden-strings check to its own workflow

Runs on every PR instead of only when VS Code paths change, so a
hardcoded forbidden URL in any package can't bypass the guard.

.github/workflows/check-forbidden-strings.yml

@@ -0,0 +1,20 @@
+name: Check forbidden strings
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check:
+    name: Check forbidden strings
+    if: github.repository == 'Kilo-Org/kilocode'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6 # kilocode_change
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Run check
+        run: bun run script/check-forbidden-strings.ts

.github/workflows/test-vscode.yml

@@ -53,7 +53,3 @@ jobs:
       - name: Check for kilocode_change markers
         working-directory: packages/kilo-vscode
         run: bun run check-kilocode-change
-
-      - name: Check for forbidden strings
-        working-directory: packages/kilo-vscode
-        run: bun run check-forbidden-strings

packages/kilo-vscode/package.json

@@ -896,7 +896,6 @@
     "format:check": "prettier --check .",
     "knip": "knip",
     "check-kilocode-change": "! grep -rIn 'kilocode_change' . ../kilo-ui/ --exclude='package.json' --exclude='*.md' --exclude-dir='node_modules' --exclude-dir='dist' | grep -v '`kilocode_change`'",
-    "check-forbidden-strings": "bun ../../script/check-forbidden-strings.ts",
     "lint": "eslint src webview-ui",
     "test": "vscode-test",
     "test:unit": "bun test tests/unit/",

script/check-workflows.ts

@@ -29,6 +29,7 @@ const DIR = path.join(ROOT, ".github", "workflows")
 const active = new Set([
   "auto-docs.yml",
   "beta.yml",
+  "check-forbidden-strings.yml",
   "check-kilo-generated-artifacts.yml",
   "check-md-table-padding.yml",
   "check-opencode-annotations.yml",