Sidecar spawn-time failures bypass crash backoff — unthrottled respawn storm

SidecarManager::ensure_running propagates spawn_process errors without engaging any backoff (src/sidecar/manager.rs), and the exponential backoff lives only in handle_crash, which is reached solely from health_loop — and health_loop skips whenever the transport is None. Under a persistent spawn failure (e.g. any pre-READY exit like #110), every semantic LSP request launches a fresh doomed dotnet process with zero delay and the health monitor never engages.

Proposed: route spawn failures through the same backoff state as crashes (or track a spawn-failure timestamp and refuse respawn until the backoff elapses).

Related: #110.

Start in src/sidecar/manager.rs by tracing ensure_running, spawn_process, handle_crash, and health_loop. Confirm how crash backoff state is stored and how spawn errors currently propagate. Done means persistent spawn failures are subject to the same backoff or an equivalent delay, including when transport is None, without unthrottled process launches.