Cherry-picks the substantive ideas from #24155 (different scope, same
problem space) onto our PR.

agent/lsp/eventlog.py (new): dedicated structured logger
``hermes.lint.lsp`` with steady-state silence. Module-level dedup sets
keep a 1000-write session at exactly ONE INFO line ("active for
<root>") at the default INFO threshold; clean writes log at DEBUG so
they never reach agent.log under normal config. State transitions
(server starts, no project root for a file, server unavailable) fire
at INFO/WARNING once per (server_id, key); novel events (timeouts,
unexpected errors) fire WARNING per call. Grep recipe: ``rg 'lsp\\['``.

agent/lsp/manager.py: wire the eventlog into _get_or_spawn and
get_diagnostics_sync so users can answer "did LSP fire on this edit?"
with a single grep, plus surface "binary not on PATH" warnings once
instead of silently retrying every write.

tools/file_operations.py: backend-type gate. ``_lsp_local_only()``
returns False for non-local backends (Docker / Modal / SSH /
Daytona); ``_snapshot_lsp_baseline`` and ``_maybe_lsp_diagnostics``
now skip entirely on remote envs. The host-side language server
can't see files inside a sandbox, so this prevents pretending to
lint a file the host process can't open.

agent/lsp/protocol.py: 8 KiB cap on the header block in
``read_message``. A pathological server that streams headers
without ever emitting CRLF-CRLF would have looped forever consuming
bytes; now raises ``LSPProtocolError`` instead.

agent/lsp/workspace.py: 64-step cap on ``find_git_worktree`` and
``nearest_root`` upward walks, plus try/except containment around
``Path(...).resolve()`` and child ``.exists()`` calls. Defensive
against pathological inputs (symlink loops, encoding errors,
permission failures mid-walk) — the lint hook is hot-path code and
must never raise.

Tests:
- tests/agent/lsp/test_eventlog.py: 18 tests covering steady-state
  silence (clean writes stay DEBUG), state-transition INFO-once
  semantics (active for, no project root), action-required
  WARNING-once (server unavailable), per-call WARNING (timeouts,
  spawn failures), and the "1000 clean writes => 1 INFO" contract.
- tests/agent/lsp/test_backend_gate.py: 5 tests verifying
  _lsp_local_only / snapshot_baseline / maybe_lsp_diagnostics skip
  the LSP layer for non-local backends and route correctly for
  LocalEnvironment.
- tests/agent/lsp/test_protocol.py: new test_read_message_rejects_runaway_header
  exercising the 8 KiB cap.

Validation:
- 73/73 LSP tests pass (49 original + 18 eventlog + 5 backend-gate + 1 framer cap)
- 198/198 pass when run alongside existing file_operations tests
- Live E2E re-run with pyright still surfaces "ERROR [2:12] Type
  ... reportReturnType (Pyright)" through the full path, then patch
  fix removes it on the next call.

Consolidates fixes for issues found during a holistic review of the
LSP write_file/patch integration. Builds on top of PR #24168 HEAD
(7fa5657). Six defects from initial review + one (D7) raised by the
bot reviewer comment thread are addressed below. Bot reviewer issues
(orphan subprocesses, default-enabled aggressiveness, test failures)
are all resolved or stale; addendum patch_replace bug independently
diagnosed with same fix shape.

Defects fixed
=============

D1 patch_replace double-lint silently drops every LSP diagnostic
    `write_file` rolls the baseline forward; the outer
    `patch_replace._check_lint_delta` then sees an empty delta.
    Fix: token-keyed `_delta_baseline`; `patch_replace` captures the
    token, passes it to `write_file` via `_lsp_baseline_token=`, and
    the inner `_check_lint_delta` runs with `skip_lsp=True` so the
    token survives to the outer post-write check.

D2 Path-keyed _delta_baseline collides under concurrent gateway load
    Two chats editing the same path in different worktrees stomp each
    other's baseline. Fix: same token-keyed map (UUID per snapshot).

D3 Idle LSP subprocesses never reaped
    Long-lived gateway accumulates one LSP per (language, workspace)
    forever (pyright ~200MB, gopls ~80MB, tsserver ~150MB). Fix:
    background `_reaper_loop` coroutine scheduled on the
    `_BackgroundLoop`. `_reap_idle()` is the unit-testable single
    pass.

D4 Workspace cache unbounded + not thread-safe
    Long-lived process grows without ceiling; concurrent resolve can
    corrupt the dict. Fix: `OrderedDict` LRU bounded at 1024 +
    `threading.Lock`. Added public `invalidate_workspace_cache(path)`
    and `clear_workspace_cache()` for callers that observe workspace
    topology changes.

D5 Default install_strategy=auto triggers silent installs
    SOC 2 / ISO 27001 finding: first .py edit in a git repo triggers
    `npm install pyright` with no consent. Fix: defaults are
    `lsp.enabled: false` + `install_strategy: manual`. Both are opt-in.

D6 INSTALL_RECIPES unpinned (pyright@latest, gopls@latest)
    Supply-chain risk. Fix: every auto-install recipe pinned to a
    specific verified version. CVE notes inline for yaml-language-server
    (yaml@2.7.1 CVE-2026-33532, CVSS 4.3 low) and gopls v0.21.1
    (CVE-2026-42503, CVSS 8.8 — exploit gated on `-listen`/`-port`
    flags our default invocation doesn't use).

D7 Orphan LSP subprocesses on hermes exit
    Daemon thread death doesn't propagate SIGTERM to child language
    servers. Fix: `atexit.register(shutdown_service)` on first
    `get_service()` success + explicit `shutdown_service()` call in
    `cli._run_cleanup`. Belt + suspenders. Live-verified: child
    process spawned pyright, exited normally, atexit fired, no orphan.

Test coverage
=============

204/204 unit tests pass (26 new regression tests pin every defect).
1 live verification (D7 orphan check against real pyright).

Files
=====

agent/lsp/__init__.py        | 24  (atexit hook + idempotent shutdown)
agent/lsp/install.py         | 61  (pinned recipes + docstring fix)
agent/lsp/manager.py         | 230 (token-keyed baseline, reaper, concurrency)
agent/lsp/workspace.py       | 110 (LRU cache + lock + invalidation API)
cli.py                       | 10  (LSP shutdown in _run_cleanup)
hermes_cli/config.py         | 29  (opt-in defaults + audit-compliance comments)
tests/agent/lsp/test_service.py | 11 (token-aware delta test)
tools/file_operations.py     | 107 (3-tier lint + patch_replace D1 fix)
tests/agent/lsp/test_consolidation_regressions.py | 902 (new, regression pins)