feat(code-intel): add Go-owned read-only LSP runtime

[Qiyuanqiii]

Summary

• introduce the versioned code-intel-lsp.v1 Go-owned runtime for explicitly reviewed, SHA-256-pinned local language servers
• expose ten negotiated read-only semantic tools only to Code Surface root Plan/Deliver turns, reusing the agent-code authority, budget, paging, and result-return path
• bind semantic evidence to Workspace/root, Git commit/branch/dirty content, document hash/version, server generation, capability fingerprint, query, and page
• integrate qualification and metadata-only status into CLI, authenticated OpenAPI, Desktop settings, review, and focused-checks
• add real gopls and TypeScript Language Server coverage, fault/adversarial tests, race coverage, cross-platform process ownership, CI, and bilingual documentation
• close the command-runtime read/wait TOCTOU exposed by the full CI suite while preserving exact ownership checks for active Jobs

Security boundaries

• server executable and argv come only from explicit operator configuration; the executable is pinned and re-hashed before use
• Cyber, Specialist, rename, code action, formatting, repository-discovered commands, credentials, and raw process metadata remain unavailable
• server URIs and content are treated as untrusted and are bounded, normalized, workspace-confined, secret-sanitized, and freshness-checked
• minimal environment and no network grant do not constitute an OS sandbox; the configured local language server remains a trusted host dependency

Verification

• go test -count=1 ./... -timeout 30m
• go vet ./...
• go test -race -count=1 ./internal/codeintel ./internal/toolgateway
• real gopls v0.21.1 smoke: all ten semantic tools
• real typescript-language-server 6.0.0 / TypeScript 5.9.3 smoke: all nine advertised tools
• command-runtime terminal ownership transition: deterministic regression, 15 repetitions, and race run
• web typecheck, 63 test files / 278 tests, and production build
• Linux and macOS amd64 cross-compilation for codeintel, toolgateway, and httpapi
• deterministic OpenAPI TypeScript generation and git diff --check

Closes #116
Parent: #107