feat(fixer): add opt-in LSP graph backend with Pyright/gopls support

[yourspraveen]

Summary

Adds an opt-in Language Server Protocol (LSP) backend (VULNFIX_GRAPH_BACKEND=lsp) to vulnhunter-fix's code-graph substrate (vulnhunter_fix/graph/).

It connects via stdio JSON-RPC to host language servers (pyright for Python, gopls for Go) to resolve symbol call hierarchies semantically, eliminating text-match comment noise.

Key Changes

• Protocol Abstraction (protocol.py): Defined structural GraphBackend protocol satisfied by GraphQuery and LSPGraphQuery.
• LSP Backend (lsp_backend.py): Implemented eager workspace/symbol node indexing and lazy callHierarchy edge resolution (prepareCallHierarchy + incomingCalls / outgoingCalls) with per-query caching and stdio communication.
• Orchestration (build_graph.py): Configured via VULNFIX_GRAPH_BACKEND=lsp. Populates reachable_from_entry and gracefully degrades to baseline Grep (confidence: low) on server errors/timeouts.
• Schema (triage-schema.json): Updated JSON schema to accept graph_backend: "lsp" with confidence: "high".
• Documentation: Updated root README.md and vulnhunter-fix/README.md with installation, CLI configuration, and backend options (auto, lsp, ast, grep).

Empirical Proof of Benefit (fastapi/fastapi)

We tested build_graph.py on fastapi/fastapi comparing baseline (grep) vs lsp (Pyright):

Finding ID	Vulnerability Sink Symbol	Baseline (grep)	LSP (lsp)	Grep Callers	LSP Callers
VULN-001	fastapi/applications.py:setup	grep (low)	lsp (high)	2 (regex noise)	0 (semantic true caller)
VULN-002	fastapi/security/oauth2.py:OAuth2	grep (low)	lsp (high)	3 (regex noise)	0 (semantic true caller)
VULN-003	fastapi/dependencies/utils.py:solve_dependencies	grep (low)	lsp (high)	3 (regex noise)	0 (semantic true caller)

Grep matched text words inside comments, docstrings, and Pydantic type annotations. Pyright correctly eliminated all 8 false caller paths.

Testing

• Automated unit tests with a mock stdio JSON-RPC language server (tests/mock_lsp_server.py).
• Schema regression & protocol conformance test suite passing cleanly (pytest).