Enforce the LSP initialize, shutdown, and exit lifecycle

[Widthdom]

Summary

LSP requests currently work before initialize, a second initialize succeeds, and normal requests continue after shutdown.

Audit ID: G-21. Reproduced on v1.40.3.

Existing issue relationship

Direct regression of closed #2830 (shutdown/exit lifecycle). Closed #4336 is adjacent broad protocol-audit work.

Expected behavior

Dispatch must enforce the LSP session state: pre-initialize requests return ServerNotInitialized, duplicate initialize is InvalidRequest, and only exit is accepted after shutdown.

PR scope

Keep this to LSP lifecycle state/gating, separate from MCP.

Implementation guide for Codex 5.6 sol xhigh

• Introduce one thread-safe state machine around all dispatch paths, including notifications and errors.
• Follow the supported LSP version's required error codes and exit semantics.
• Add JSON-RPC transcript tests for initialize/initialized/shutdown/exit, out-of-order, duplicate, concurrent, and malformed sequences.
• Ensure shutdown disposes resources once without deadlock and does not accept further work.
• Run full tests and add a bilingual changelog fragment referencing LSP shutdown and exit notifications do not stop the server loop #2830.

Acceptance criteria

• All out-of-phase requests produce the required protocol errors.
• Duplicate initialize is rejected.
• After shutdown, only exit is accepted and resources are released exactly once.

[Widthdom]

Work started on branch fix-issue4849.