feat: fx adoption baseline, LSP enablement, and extension trust status

[Patel230]

Summary

Completes the Vercel fx adoption plan plus Kimi Code workflow parity:

• Kimi Code adoption: distinct planner/explorer model roles, Kimi-compatible hook lifecycle events, adoption plan docs
• fx P0: stable-ID exact permission rules with hawk permissions add/list/revoke/reset, atomic persistence, reset generation protection
• fx P0: project settings authority boundaries — .hawk/settings.json can no longer override provider/model, permission grants, MCP servers, custom providers, or thinking settings
• Unified redacted status: internal/status snapshot wired into hawk status [--json], daemon GET /v1/status, and ACP session/status; OpenAPI updated
• Subagent observability: child sessions surfaced in ACP status
• LSP fix: subprocess LSP manager wired into the primary chat tool registry (lazy start); diagnostics/definition/references/symbols route through configured language servers with codegraph/local-tool fallbacks
• Extension trust UX: MCP/skills state and trust warnings in status snapshots

Test plan

• Full go test ./... passes (run twice, including via pre-push hooks)
• make vet, make lint clean
• hawk verify passed (security log verified)
• Boundary guards + external-drift + govulncheck passed in pre-push hooks