Lands the cheap-and-high-value subset of the post-v0.1.1 review pass.

R1 — extension.ts: move the filterByThreshold import up to the rest
of the import block. Was sitting after a function declaration as a
merge artefact.

R2 — extension.ts: "Restart language server" toast no longer fires
when startClient failed. The catch path already surfaces its own
error notification; the success toast now gates on `if (client)`.

R3 — extension.ts: stopClient races local.stop() against a 2-second
timer (STOP_TIMEOUT_MS) and dispose()s the client on timeout. A
deadlocked LSP child used to hold the deactivate path indefinitely
and VS Code reported "Window not responding".

R4 — findingsView.ts: groupByFile drops the Uri.parse round-trip.
Bucket value now carries the original Uri alongside the items array.

R5 — findingsView.ts: compareByLocation sorts on fsPath instead of
the full URI string. Cross-scheme entries (file:// vs untitled://)
no longer bunch at one end of the tree.

R6 — findingsView.ts: collectFindings memoised behind a per-refresh
cache. buildRoot and updateBadge used to walk the workspace
diagnostic store twice per refresh; now both read from the same
walk. cachedFindings is invalidated in refresh().

R7 — findingsView.ts: onDidChangeDiagnostics handler now early-outs
when the batch's URIs neither carry a pipeline-check diagnostic nor
appeared in the last finding set. ESLint / mypy / redhat.yaml
keystroke chatter no longer wakes up the tree rebuild. The
lastFindingUris set carries the URIs we last had findings for so
*clears* are detected too (a stale leaf can't outlive a cleared
file).

R8 — findingsView.ts: leaf tooltip now appends a "$(book) RULE
documentation" link when the server publishes Diagnostic.code.target.
MarkdownString gets isTrusted=true so the link is clickable inside
a TreeItem tooltip. composeLeafTooltip extracted as a function for
unit testing.

R9 — statusBar.ts: new module. Adds a left-side status bar item
showing per-severity counts (e.g. "$(shield) 3C 1H"). Click reveals
the Findings panel via the auto-generated pipelineCheck.findings.focus
command. Updates on every onDidChangeDiagnostics; pure helpers
(formatStatusBarText, formatStatusBarTooltip, countDiagnostics) live
on the module so the tests pin the copy without booting VS Code.

R21 — ci.yml: matrix over [ubuntu-latest, windows-latest,
macos-latest]. npm audit and the vsix upload stay pinned to Linux
(network-bound / would otherwise collide on identical names).
fail-fast: false so a Windows-only failure doesn't kill the macOS
and Linux runs.

Tests:
- findingsView.test.ts: MarkdownString stub gains appendMarkdown /
  isTrusted / supportThemeIcons. getDiagnostics stub handles both
  the zero-arg (all pairs) and uri-arg (just that URI) forms used by
  R7's batch-touches-us check.
- findingsView.test.ts: +3 tests covering R8 (link appended when
  docsUrl present, tooltip clean when absent) and R6 (refresh() picks
  up newly-published diagnostics).
- statusBar.test.ts: new file. 13 tests across formatStatusBarText
  (clean / critical-first / high-pair / collapse-to-total),
  formatStatusBarTooltip (no findings / breakdown / singular), and
  countDiagnostics (source filter / tally / INFO fallback / lowercase
  normalise).

Total: 53 tests pass; lint + smoke clean. Three-OS CI verifies on
each push.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>