fix(lsp): crash-safety — panic recovery, layout canary, race+lint CI

[klaidliadon]

A malformed document can currently take down the whole language server: go.lsp.dev runs every request in its own goroutine and recovers nothing, so a single panic in a handler — very reachable given the unsafe.Pointer parser mirrors — kills the process and every editor feature with it. This adds a panic-recovery middleware so a panic degrades to one failed request, plus a canary test that turns silent unsafe layout drift into a red build, and tightens CI to actually catch races and lint regressions.

First of three stacked PRs hardening ridl-lsp for production (from a Claude↔Codex audit). This one is the base — safe to merge first, no dependency on the others.

---

Changes (audit findings)

• C1 — panic recovery (internal/lsp/recover.go): RecoverHandler wraps the protocol ServerHandler (inside ReplyHandler), recovers panics, logs method + stack, and replies a JSON-RPC error when no reply was sent yet. A recovered panic never propagates as a returned error (jsonrpc2 treats that as connection-fatal) and never double-replies. Wired in main.go by replicating protocol.NewServer's setup.
• C2 — layout canary (internal/ridl/layout_canary_test.go, parser.go): the parser reads unexported webrpc/webrpc types through hand-mirrored structs via unsafe.Pointer, previously unguarded. Added a canary that parses a fixture with known positions and asserts every mirrored read (token line/col, error code/message/status, inline-struct arg, parser root); converted the never-read leading mirror fields to blank _ padding (same layout, documents intent, clears the unused linter).
• I5 — CI gate (.github/workflows/ci.yml): run tests with -race and add a golangci-lint step (same go run + .golangci.yml the Makefile uses, minus --fix).
• prep (internal/lsp/semantic_document.go): drop a redundant []rune conversion (staticcheck SA6003) so the lint gate goes green.

Test plan

$ go test -race ./...
Go test: 123 passed in 6 packages

$ go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint run ./... -c .golangci.yml
0 issues.

Canary teeth verified: inserting one bogus field ahead of line/col in the mirror made TestUpstreamLayoutCanary fail (TokenLine returned 18 instead of 6); reverted.

Review

Self-review (2 angles), security-review, and a Codex adversarial pass all returned zero Critical/Important findings. Codex's lone Suggestion — go run golangci-lint is toolchain-sensitive — is intentionally kept: it matches the repo's existing make lint, and CI pins Go 1.25.0 via go-version-file.

---

Stack: ridl-lsp-hardening

1. fix(lsp): crash-safety — panic recovery, layout canary, race+lint CI #8 ◀ this PR
2. perf(lsp): parse-pipeline hardening — immutable docs, partial-result cache, cancellation, workspace pruning #9
3. feat(lsp): polish — graceful shutdown, log level, upstream error-format canaries #10

_{This stack is managed with sdf.}