salvage: batch 2 LSP-related fixes (#24738 lsp gating + #24929 mutation diagnostics false positive)

[kshitijk4poor]

Salvage of two independent LSP-related fixes

Cherry-picks two small, unrelated bug fixes from open PRs onto current main. Both authors are preserved as commit authors and are already in AUTHOR_MAP.

Original PR	Author	Subsystem	Fix
#24738	@briandevans	CLI startup gating	Adds lsp to _BUILTIN_SUBCOMMANDS so hermes lsp … skips the ~500-650ms plugin-discovery pass.
#24929	@GodsBoy	Tool result classification	Stops misclassifying successful write_file/patch results as failures when their JSON payload contains nested lint or LSP diagnostics with "error" keys (issue #24927).

Two independent fixes are batched here because each is small, the diffs touch disjoint files, and neither has interactions with the other. Each retains its original contributor as commit author.

#24738 — lsp missing from _BUILTIN_SUBCOMMANDS

The parity guard added in #22120 (tests/hermes_cli/test_startup_plugin_gating.py::test_builtin_set_covers_every_registered_subcommand) has been failing on main since lsp shipped via #24168. Verified empirically:

$ bash scripts/run_tests.sh tests/hermes_cli/test_startup_plugin_gating.py
FAILED test_builtin_set_covers_every_registered_subcommand
  AssertionError: _BUILTIN_SUBCOMMANDS is missing these live subcommands: ['lsp'].

After the fix: 37 passed.

#24929 — File mutation false positive on diagnostic-bearing results (#24927)

_detect_tool_failure() and classify_tool_failure() substring-match '"error"' and '"failed"' over the full result string. After PR #24168 wired post-write LSP diagnostics into write_file and patch, any successful mutation whose result includes nested lint/LSP errors gets a [error] failure tag in the CLI display, plus a turn-end verifier footer claiming the write didn't land — even though it did.

This PR introduces a shared agent/tool_result_classification.py::file_mutation_result_landed() helper and patches three callsites:

• agent/display.py::_detect_tool_failure() — CLI failure tag
• agent/tool_guardrails.py::classify_tool_failure() — guardrail mirror
• run_agent.py::_record_file_mutation_result() — turn-end verifier upstream

A duplicate PR (#24960) was filed against the same issue. It has a real bug (data.get("bytes_written") truthiness check, which misclassifies an empty 0-byte write with lint diagnostics as a failure). #24929 uses "bytes_written" in data (presence check) which is correct. We are closing #24960 in favor of this salvage.

Test plan

bash scripts/run_tests.sh \
  tests/hermes_cli/test_startup_plugin_gating.py \
  tests/agent/test_display.py \
  tests/agent/test_tool_guardrails.py \
  tests/agent/test_tool_result_classification.py \
  tests/run_agent/test_file_mutation_verifier.py

Result: 117 passed.

E2E sanity:

• 'lsp' in _BUILTIN_SUBCOMMANDS → True
• _detect_tool_failure("write_file", '{"bytes_written": 0, "lint": {"errors": [{"severity": "error"}]}}') → (False, "") (would be (True, " [error]") without the fix; this is the case PR fix(agent): prevent mutation verifier false positives from lint diagnostics #24960 mishandles)
• _detect_tool_failure("write_file", '{"error": "Permission denied"}') → (True, " [error]") (genuine failures still detected)
• _detect_tool_failure("patch", '{"success": true, "lsp_diagnostics": "<diagnostics>ERROR foo</diagnostics>"}') → (False, "")

Closes #24927 (via #24929).
Supersedes #24738, #24929, #24960.

cc @briandevans @GodsBoy — your commits are preserved as-is in this salvage; original authorship intact in git log.