⬆️ Bump the pi-lsp pin to 0.0.47

The agent-side LSP extension is declared in `.pi/settings.json`, not in
`package.json`, so neither `npm update` nor `maintain:outdated` sees it.
Bump it with `pi install npm:@spences10/pi-lsp@0.0.47 -l`, which
rewrites the pin and refreshes the gitignored `.pi/npm/` install cache,
then reformat the file: pi writes it back in its own two-space style,
which `check:oxfmt` rejects.

0.0.47 bounds the project-binary trust prompt — it follows tool
cancellation and times out after 30 s, returning a tool error instead of
leaving the session stuck in `Working`, and an allow-once decision now
survives an idle language-server restart. The read-only usage and the
`tsc --lsp` wiring are unchanged, so `development/tooling.md` only moves
the recorded version. No changelog note: the pin is agent tooling, not
shipped code, as when it was adopted (863198d).

The running pi session still has 0.0.46 loaded; restart pi to pick up
the new version.

.pi/settings.json

@@ -1,3 +1,3 @@
 {
-    "packages": ["npm:@spences10/pi-lsp@0.0.46"]
+    "packages": ["npm:@spences10/pi-lsp@0.0.47"]
 }

development/tooling.md

@@ -328,7 +328,7 @@ of a hand-rolled JSON-RPC client.
 
 #### Decision (2026-09)
 
-`@spences10/pi-lsp` is pinned to `0.0.46` and used read-only.
+`@spences10/pi-lsp` is pinned to `0.0.47` and used read-only.
 
 #### Why