fix: Array move ownership, selfhost -g flags, LSP workspace/symbol

Session 36: prevent UAF when Array is moved into a struct field (Nexus
headers), align selfhost cc flags with bootstrap debug/release, and add
workspace/symbol search to bux-lsp 0.6.

- Parser: zero headers after embedding so auto-drop is a no-op
- Request_WantsKeepAlive uses RequestHeader_Get again safely
- Selfhost: default -O0 -g; --release -O2 -DNDEBUG; BUX_CFLAGS
- LSP: workspace/symbol + smoke; version 0.6.0

apps/nexus/src/Parser.bux

@@ -100,7 +100,9 @@ module Parser {
 
         // Find header/body boundary
         let boundary: String = bux_strstr(raw, "\r\n\r\n");
-        var headers: Array<HeaderEntry> = Array_New<HeaderEntry>(16);
+        // Only one allocation path — avoid Array_New then overwrite (leak) and
+        // suppress auto-drop after moving into HttpRequest (use-after-free).
+        var headers: Array<HeaderEntry>;
         var body: String = "";
         if String_Len(boundary) > 0 {
             let headerEnd: uint = bux_str_offset(boundary, raw);
@@ -114,6 +116,7 @@ module Parser {
         }
 
         if String_Eq(path, "") {
+            // auto-drop of `headers` runs on return
             return ParseResult_NewErr(HttpError { tag: HttpError_BadRequest });
         }
 
@@ -124,6 +127,11 @@ module Parser {
             body: body,
             headers: headers,
         };
+        // Ownership transferred into req — zero local shell so auto-drop is a no-op.
+        // (Compiler does not yet treat field-move as a move-out of the local.)
+        headers.data = null as *HeaderEntry;
+        headers.len = 0;
+        headers.cap = 0;
         return ParseResult_NewOk(req);
     }