Diagnose possible encoding mismatch and preserve cancelled reopen edits

[jonaraphael]

The original #76 attachment is not valid UTF-8: its product-name bytes decode correctly with explicit CP437 or CP850, which are indistinguishable for that particular file. CSV renders VS Code's already-decoded TextDocument, so correcting this input requires reopening the original bytes with the source encoding before saving.

Add a once-per-document, nonmodal warning when replacement characters suggest a possible decoding mismatch, with an action bound to that file's existing encoding command. Stop the encoding flow when closing a dirty tab is cancelled, preserving unsaved edits. Document Reopen with Encoding and the supplied fixture's ambiguity. No automatic encoding inference, transcoding or repair of already replaced text; U+FFFD may also be legitimate, and other kinds of wrong decoding may not trigger the warning.

Addresses #76. This does not claim automatic encoding detection or replace VS Code's decode/save pipeline.

Stacked on #109 (base codex/fix-edit-integrity) for safe document operation ordering and behavioral test fixtures.

Validation:

• Node20 npm ci, npm test (includes compile; 127 passing), npm run lint (0 errors, 87 existing warnings), git diff --check.
• Original 4,052-byte attachment committed without conversion; explicit CP437/850 decode equality and CP437 encode byte equality verified.
• Tests cover accented rendering/edit/save text, UTF-8 CSV/TSV, possible-mismatch warning/action/dismissal, and native-picker flow including dirty-close cancellation, rejection/disposal handling and awaiting picker completion.
• VS Code APIs are mocked; actual native encoding-picker UI and file-save codec behavior require extension-host review. Installed VS Code implementation was inspected to confirm CP437/850 picker entries and the two-step Reopen/Save encoding flow. In installed VS Code 1.117.0, the native async command awaits the action picker, encoding picker, optional dirty revert, and setEncoding before returning; this is source-level evidence, not native GUI E2E for every supported version.

Independent orchestrator review: final warning rejection/disposal safeguards passed compile, lint and all 127 tests. Current CI succeeds and the PR is mergeable. This provides safe encoding guidance; it does not uniquely auto-detect CP437/CP850 or transcode files.

Cross-feature integration: the isolated combined checkout containing #109, #111–#120 (excluding partial #110) passes compile, lint (0 errors; existing warnings) and 242 tests. Shared manifest/command conflicts were resolved and checked in that integration branch. No PRs have been merged.