[ORESoftware]

What changed

Adapts the merged VS Code foundation to the shared inspect v1 contract under review in zed-pkg/zed-cli#235 / issue zed-pkg/zed-cli#191.

• invoke zed inspect --format json --root <absolute-path>;
• accept additive schema_version 1.x reports only;
• require the CLI safety declaration implementation=zed-pkg, command=inspect, offline=true, mutates_project=false, and loads_credentials=false;
• bind the report root to the requested workspace after realpath canonicalization so symlinked roots remain valid but cross-workspace reports fail closed;
• normalize v1 diagnostics into the existing extension issue model;
• normalize zed-command argv/cwd recommendations into the centrally confirmation-gated action model;
• reject non-zed executables, incomplete action safety metadata, and action working directories outside the canonical inspected workspace;
• preserve and display mutatesProject, requiresNetwork, and executesPackageCode risk metadata in output, Quick Pick, and the modal confirmation;
• preserve deterministic local fallback for unavailable/unsupported CLI reports.

Safety

This PR does not make the extension a solver and does not weaken its execution boundary. CLI recommendations still cannot execute without the extension's modal confirmation. Child processes continue to use argv-only spawn(..., { shell: false }), bounded timeouts, and output redaction.

Tests

Adds coverage for the new argv, safe v1 diagnostic/action normalization, root binding, unsafe safety declarations, non-zed executable rejection, out-of-workspace cwd rejection, action-risk preservation, and fallback non-mutation.

Tracking

• Linear: DEN-2278 / DEN-2508 / DEN-2175
• shared product contract: zed-pkg/zed-cli#235, current exact head 70fd364c5cf592e2ba03aed3670b4c1601c0836c
• independent CLI acceptance: zed-pkg-test/zed-pkg-e2e#119
• real CLI/adapter interoperability: zed-pkg-test/zed-pkg-e2e#125, pinned to this VS Code head 05835dbea0c081c7128d98a219d7731fbd20d941

Draft until the shared CLI v1 head is promoted and this exact VS Code head is green in repository CI plus the independent real-binary interop lane.

[linear-code]

DEN-2278