fix: Address immediate code review issues in C# language server

- Fix command injection vulnerability by passing cmd_parts array directly to ProcessLaunchInfo
- Update docstring to correctly reference Microsoft.CodeAnalysis.LanguageServer
- Remove string concatenation for shell commands to prevent injection attacks

These changes address the high-priority security and documentation issues identified in code review.

.claude/settings.local.json

@@ -40,7 +40,8 @@
       "Bash(git commit:*)",
       "Bash(git push:*)",
       "Bash(curl:*)",
-      "WebFetch(domain:github.com)"
+      "WebFetch(domain:github.com)",
+      "mcp__zen__codereview"
     ],
     "deny": []
   }

src/solidlsp/language_servers/csharp_language_server/csharp_language_server.py

@@ -1,5 +1,5 @@
 """
-CSharp Language Server using csharp-ls (Roslyn-based LSP server)
+CSharp Language Server using Microsoft.CodeAnalysis.LanguageServer (Official Roslyn-based LSP server)
 """
 
 import logging
@@ -99,13 +99,12 @@ class CSharpLanguageServer(SolidLanguageServer):
         else:
             logger.log("No .sln or .csproj file found, language server will attempt auto-discovery", logging.WARNING)
         
-        cmd = " ".join(cmd_parts)
-        
+        # Pass command parts as array to avoid shell injection vulnerabilities
         super().__init__(
             config,
             logger,
             repository_root_path,
-            ProcessLaunchInfo(cmd=cmd, cwd=repository_root_path),
+            ProcessLaunchInfo(cmd=cmd_parts, cwd=repository_root_path),
             "csharp",
         )