feat(client): wire restart/showLog commands + sample-workflow F5 profile

Bring the extension up from "just a scaffold" to "F5 reaches the
upstream pygls server and surfaces real diagnostics." Three pieces:

1. src/extension.ts. The `activate` path now goes through a
   buildClient -> startClient -> error-handler flow. When
   `client.start()` fails (Python missing, [lsp] extra not
   installed, server crash on import), the user sees a
   notification carrying the underlying error message and the
   install hint `pip install "pipeline-check[lsp]"`, plus an
   "Open server log" button that focuses the `Pipeline-Check`
   output channel. The broken client is discarded so the next
   restart starts fresh.

2. Two commands. `pipelineCheck.restart` stops the running
   client and re-spawns; `pipelineCheck.showLog` focuses the
   output channel where the server's `window/logMessage` traffic
   lands. Registered in package.json under the `Pipeline-Check`
   category so the command palette groups them together.

3. A second launch profile: `Run Extension (sample workflow)`
   opens `test-fixtures/sample-workflow/` as the workspace.
   The fixture ships a deliberately-vulnerable GHA workflow that
   should fire GHA-001 / GHA-004 / GHA-015 / GHA-016 the moment
   the file opens — quickest way to confirm the client -> server
   -> diagnostic-publish round-trip works end-to-end. The
   fixture is .vscodeignore'd so it does not ship in the vsix.

Also lands package-lock.json (npm install pinned the dep tree)
and an expanded README "Development" section covering the two
F5 profiles plus the new commands.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dmartinochoa

.vscode/launch.json

@@ -12,6 +12,19 @@
         "${workspaceFolder}/out/**/*.js"
       ],
       "preLaunchTask": "npm: compile"
+    },
+    {
+      "name": "Run Extension (sample workflow)",
+      "type": "extensionHost",
+      "request": "launch",
+      "args": [
+        "--extensionDevelopmentPath=${workspaceFolder}",
+        "${workspaceFolder}/test-fixtures/sample-workflow"
+      ],
+      "outFiles": [
+        "${workspaceFolder}/out/**/*.js"
+      ],
+      "preLaunchTask": "npm: compile"
     }
   ]
 }

.vscodeignore

@@ -1,6 +1,7 @@
 .vscode/**
 .vscode-test/**
 src/**
+test-fixtures/**
 .gitignore
 .eslintrc.json
 tsconfig.json

README.md

@@ -40,7 +40,15 @@ npm run compile     # one-shot compile
 npm run watch       # rebuild on change
 ```
 
-Press <kbd>F5</kbd> in VS Code with this folder open to launch an extension-host instance with the extension loaded. The `Run Extension` launch profile is committed in `.vscode/launch.json`.
+Press <kbd>F5</kbd> in VS Code with this folder open to launch an extension-host instance with the extension loaded. Two debug profiles ship in `.vscode/launch.json`:
+
+- **Run Extension** — opens a fresh window with no workspace. Use this when iterating on the client wiring against a checkout of your own code.
+- **Run Extension (sample workflow)** — opens `test-fixtures/sample-workflow/` as the workspace. The fixture is a deliberately-vulnerable GitHub Actions workflow and should produce four diagnostics (GHA-001, GHA-004, GHA-015, GHA-016) the moment you open the file. Quickest way to confirm the client → server round-trip works end-to-end.
+
+Two commands are registered in the running extension:
+
+- **Pipeline-Check: Restart server** — kills and respawns the LSP process. Useful after editing the Python server in a sibling checkout.
+- **Pipeline-Check: Show server log** — focuses the `Pipeline-Check` output channel where the server's `window/logMessage` traffic lands.
 
 ## Packaging