> Last time I used zed for go development it spawned nodejs servers (downloaded without asking for permission!) for god knows what.

LSPs, they are snagging the LSPs made by other developers for languages you are using. if you install any LSP or language support in VSCode its running the same thing. It only installs when you are using a language that has default support such as Rust, Python (which I believe uses a Node.js LSP), Go (same as Python), etc.