Add AST call handoff and LSP graph enrichment pipeline

[slbug]

AST finds unresolved calls, optional LSP hooks try to resolve them, and only boringly safe evidence gets promoted back into the graph. No more turning every first, map, or id into a fake god node. Hooks are opt-in, cached, documented, and wired.

[safishamsi]

This is a well-engineered addition — the two-stage architecture (AST records unresolved_calls, optional LSP hooks promote them to INFERRED edges) is clean, the conservative promotion policy is correct, and the 1133-line test file is thorough. Three fixes needed before we merge:

1. LSP failure should degrade gracefully (must fix)
In watch.py around the LSP enrichment call, a hook failure raises an exception that causes the entire watch rebuild to return False. Since hooks are opt-in enrichment (not core), a failure should log a warning and continue with the pre-enrichment graph — not abort the rebuild. Please wrap the LSP enrichment call in a try/except that logs and continues.

2. Zombie processes on LSP client shutdown (must fix)
In lsp_definition_hook.py, the close() method calls proc.terminate() on timeout but never follows it with proc.wait(). This leaves zombie processes. Please add proc.wait(timeout=5) (with a kill() fallback) after terminate().

3. required default is asymmetric with docs (should fix)
The code defaults required=True for omitted hook config fields, but every example in docs/lsp-hooks.md sets "required": false. A user following the docs verbatim gets optional hooks, but one who omits the field gets required hooks — surprising. Please either flip the default to False or update the docs examples to omit the field.

Once these three are addressed we'll merge. Great work on this one.

[slbug]

@safishamsi done

[slbug]

@safishamsi any more changes required?