perf(schema/store): decide auto-load eligibility once per schema

bind_document ran auto_loadable before consulting auto_attempted, so a
document whose schema never loads paid the workspace-containment
canonicalize() syscalls on every change. Recording the attempt first
also covers ineligible schemas, which previously never entered the set
and were re-probed forever.

A file schema outside one referring document's directory is no longer
retried when a second document in a different directory binds it while
no workspace root is known. That case keeps the explicit download lens.

src/schema/store.rs

@@ -27,8 +27,9 @@ pub struct SchemaStore {
     memory: HashMap<String, Arc<SchemaDocument>>,
     pending: HashSet<String>,
     want_network: HashSet<String>,
-    /// Schemas whose one automatic (non-network) load has been kicked off, so
-    /// editing does not re-probe the cache on every change.
+    /// Schemas whose one automatic (non-network) load has been decided, so
+    /// editing does not repeat the cache probe or the workspace-containment
+    /// filesystem check on every change.
     auto_attempted: HashSet<String>,
     waiting: HashMap<String, HashSet<String>>,
     doc_schema: HashMap<String, String>,
@@ -76,9 +77,11 @@ impl SchemaStore {
             return Some(Arc::clone(schema));
         }
 
-        // Attempt an automatic, non-network load at most once per schema.
-        if self.auto_loadable(&url, &doc.uri)
-            && self.auto_attempted.insert(url.clone())
+        // Decide the automatic, non-network load at most once per schema.
+        // The order matters: `auto_loadable` canonicalizes paths, and this
+        // runs on every change, so the syscalls must sit behind the set.
+        if self.auto_attempted.insert(url.clone())
+            && self.auto_loadable(&url, &doc.uri)
         {
             self.enqueue(url, doc.uri.clone(), false);
         } else {