ci: move forbidden-strings check to its own workflow

Runs on every PR instead of only when VS Code paths change, so a
hardcoded forbidden URL in any package can't bypass the guard.

.github/workflows/check-forbidden-strings.yml

@@ -0,0 +1,20 @@
+name: Check forbidden strings
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check:
+    name: Check forbidden strings
+    if: github.repository == 'Kilo-Org/kilocode'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6 # kilocode_change
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Run check
+        run: bun run script/check-forbidden-strings.ts

.github/workflows/test-vscode.yml

@@ -53,7 +53,3 @@ jobs:
       - name: Check for kilocode_change markers
         working-directory: packages/kilo-vscode
         run: bun run check-kilocode-change
-
-      - name: Check for forbidden strings
-        working-directory: packages/kilo-vscode
-        run: bun run check-forbidden-strings