LSP Phase 4: orchestrator (lazy spawn + inflight dedup + fan-out)

[yogthos]

Phase 4 of 9. Stacked on #27 (Phase 3). Two commits:

1. `Consolidate URI helpers + switch notify_open to tokio::fs` — moves the duplicate `path_to_file_uri` / `percent_encode_path` / `uri_to_path` / `percent_decode` helpers from `init.rs` and `client.rs` into a shared `src/lsp/uri.rs` module. Both call sites now import the same code. `notify_open` switches from `std::fs::canonicalize` + `std::fs::read_to_string` to the tokio equivalents so the orchestrator can fan `touch_file` out without blocking the runtime thread.

2. `LSP Phase 4: orchestrator with lazy spawn, inflight dedup, fan-out` — the headliner.

What's in this PR

`src/lsp/spawn.rs` — Spawner trait + ProcessSpawner

• Trait so the orchestrator unit-tests against in-memory duplex pipes (no real `rust-analyzer` in CI).
• `Spawned { reader, writer, init_options, guard }` — the guard is `Box<dyn Any + Send + Sync>` holding the `tokio::process::Child` (or fake-server JoinHandle for tests). Drop terminates.
• `ProcessSpawner` spawns via `tokio::process::Command` with `kill_on_drop(true)` and drains stderr in the background so chatty servers like rust-analyzer don't deadlock on a full pipe.

`src/lsp/manager.rs` — `LspManager`

• `get_clients(file)`: walks the builtin registry, picks servers that claim the extension, resolves workspace root via `server.root()`, spawns lazily, caches by `(root, server_id)`. Inflight spawns are deduped via `Arc` — concurrent agent tool calls never race two rust-analyzer processes for the same workspace.
• Broken-set blocks retry on failed spawns.
• `touch_file(path, TouchMode)`: `Notify` (didOpen/didChange only) or `AwaitPush { after, timeout }` (additionally block on `wait_for_push` so the edit tool can surface fresh diagnostics in its tool result).
• Fan-out helpers for the agent tool that lands in Phase 5: `hover`, `definition`, `references`, `implementation`, `document_symbol`, `workspace_symbol`, `prepareCallHierarchy` + `incoming/outgoingCalls`. Per-client errors are debug-logged and swallowed — one slow server doesn't poison the result.
• On `Drop`, every cached client's `guard` drops and the child process is killed.

Test coverage

• 3 spawn tests: initialize handshake round-trips through the mock, calls recorded, failure path works.
• 8 manager tests including regressions:
  • First call spawns + caches; second call cache-hits without spawning.
  • Regression: concurrent `get_clients` only spawns ONE process — three parallel callers with a 40 ms delay all observe a single spawn count.
  • Regression: failed spawn marks broken + no retry — second call must not re-attempt.
  • No-server extension returns empty without spawning.
  • `touch_file` calls `notify_open` on the attached client.
  • Manager drop doesn't deadlock on the state mutex.

Code review fixes applied before push

• Notify race: subscribers arriving after `notify_waiters` fires would hang. Added a 60 s safety timeout on the joiner-side await; the cache is authoritative either way, so re-check after the wait terminates regardless of how.
• Lock-held-during-logging: moved `tracing::warn` calls in `get_or_spawn` out of the state-lock critical section via a `SpawnOutcome` enum that threads outcome past lock release.

Test plan

• `cargo build` clean
• `cargo test --bin dirge -- --skip plugin` → 391 passing (was 380; +11 from Phase 4)
• `cargo fmt --check` clean
• End-to-end against real rust-analyzer comes in Phase 6 once the edit tool wires this up.

Next: Phase 5 (agent-facing `lsp` tool that exposes the orchestrator to the LLM).