Quality review + bugfix: v0.3 surface

[djankov]

Summary

End-of-milestone quality review of the v0.3 surface (field catalogue, linter, pygls LSP, VS Code extension). Every formal gate was already green — ruff check, ruff format --check, mypy --strict, and 2209 tests; the catalogue (102 types / 2614 fields), the linter's zero-false-positive bar on the stock R2026a corpus, and the extension's id/scopeName/launch wiring all hold. An adversarial review across the surface surfaced two real robustness gaps the corpus and feature tests miss, both fixed here with regression coverage, plus hygiene and a coverage close-out:

• LSP diagnostics path could crash the connection. refresh_diagnostics (the didOpen / didChange path) went straight to diagnostics_for without the _safe wrapper the request handlers use. A buffer nested deep enough to exhaust the recursion limit parses cleanly, so the linter's recursive reference collector walks it and raises RecursionError out of the notification handler — contradicting the module's documented "can never crash the connection" guarantee (the existing "survive malformed input" tests only feed syntax-error buffers). refresh_diagnostics now runs through _safe and publishes an empty list instead.
• format_edits leaked RecursionError. It caught only (ValueError, TypeError), so the whole-document formatter's RecursionError on a deeply nested expression escaped its documented "yields no edit" contract. It now catches RecursionError too.
• Hygiene. Removed the #19 / #20 / #21 issue numbers from shipped module docstrings/comments (kept out of source per convention), and corrected the rules.py docstring that claimed nine structural checks — there are eight.
• Coverage. Closed the four remaining partial branches to 100% line + branch on the v0.3 surface: pragma: no branch on the three grammar-guaranteed is not None guards in the reference collector (unreachable on a clean parse, which is the only path the linter walks), and a test exercising the value_references cache hit.

Out of scope (noted, not changed): the underlying recursion in format() and the reference collector is left intact — the LSP boundary is what must stay up, and rewriting those walkers iteratively is a larger change than this review warrants. A library caller passing a 500-deep nested expression still gets a RecursionError, which is acceptable.

Test plan

• uv run pytest — 2213 passed (4 new regression tests)
• uv run pytest --cov=gmat_script — 100% line + branch overall, including catalog.py, lint/, and lsp/
• uv run mypy — clean (src + tests, strict)
• uv run ruff check and uv run ruff format --check — clean
• Catalogue data integrity audited (no missing keys, dangling aliases, or typo'd ref-targets); linter re-confirmed zero ERROR/WARNING findings across the 171-file stock corpus; extension source verified consistent end-to-end

Closes #24