feat(lsp): polish — graceful shutdown, log level, upstream error-format canaries

[klaidliadon]

Final hardening layer: a supervised/containerized server now shuts down cleanly on a signal and reports a spec-correct exit code, logging is tunable for field debugging, and the fragile string-coupling to the upstream parser's error wording is pinned so an upstream bump fails CI loudly instead of silently breaking diagnostics.

Third of the prod-readiness stack. Depends on #8 and #9 — merge those first.

⚠️ Stack: #8 → #9 → this PR. Do not merge before #9.

---

Changes (audit findings)

• I4 — pin upstream error-format coupling (ridl/parser.go, tests): diagnostics depend on the exact wording/shape of upstream webrpc parser errors (a schema error: version is required… substring match, and a line:col: regex). There's no typed-error alternative upstream, so a wording change would silently break import handling and collapse diagnostic positions. Named the matched substrings as constants and added canaries (TestVersionRequiredErrorFormat, TestUpstreamErrorFormatCanary) that fail CI on drift.
• S1 — graceful shutdown (cmd/ridl-lsp/main.go, lsp/server.go): derive the root context from signal.NotifyContext(SIGINT, SIGTERM) so the Docker ENTRYPOINT shuts down cleanly; the exit handler reports the LSP-spec exit code (0 if shutdown was received, else 1). Lifecycle methods are dispatched synchronously so the exit code can't lose a race with the transport EOF (see review note).
• S2 — configurable log level (cmd/ridl-lsp/main.go): RIDL_LSP_LOG_LEVEL (debug/info/warn/error); an invalid value is reported and ignored rather than failing startup.
• chore (S3/S4/S5): overlayContents snapshots docs.All() once; memFileInfo.ModTime returns a zero time (deterministic, parser ignores it); git describe falls back to --always/dev and Docker defaults VERSION=dev for untagged builds.

Test plan

$ go test -race ./...
Go test: 139 passed in 6 packages

$ go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint run ./... -c .golangci.yml
0 issues.

New tests: error-format canaries (parser_test.go, upstream_error_format_test.go), exit-code contract (lifecycle_test.go unit + exit_e2e_test.go subprocess), log-level parsing (main_test.go).

Review

Self-review caught an Important issue: the first exit-code cut exited non-zero on any stream close without shutdown — wrong, because editors routinely tear down by just closing the pipe. Reworked so the exit code is owned by the exit notification. A Codex adversarial pass (via agent-comms, 2 rounds) then reproduced a subtler race — AsyncHandler runs exit in a goroutine that loses to EOF on conn.Done() — fixed by dispatching shutdown+exit synchronously in the read loop, with an end-to-end subprocess test. Security-review: no findings.

---

Stack: ridl-lsp-hardening

1. fix(lsp): crash-safety — panic recovery, layout canary, race+lint CI #8
2. perf(lsp): parse-pipeline hardening — immutable docs, partial-result cache, cancellation, workspace pruning #9
3. feat(lsp): polish — graceful shutdown, log level, upstream error-format canaries #10 ◀ this PR

_{This stack is managed with sdf.}