Fix installer staging, release RID checks, and doctor diagnostics

[Widthdom]

Summary

• Hardened install.sh staging-directory permissions immediately after mktemp -d so installer cleanup is not exposed before chmod.
• Added release aggregation checks for all currently published RID archives and made the installer smoke test explicitly document its linux-x64 coverage.
• Added cdidx doctor, a redacted diagnostics summary for support/debugging, with help, docs, and tests.

Validation

• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release -p:UseSharedCompilation=false --filter "FullyQualifiedName~ProgramCliTests|FullyQualifiedName~InstallScriptTests|FullyQualifiedName~ReleaseWorkflowTests"
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet src/CodeIndex/bin/Release/net8.0/cdidx.dll doctor
• Adversarial review: No blocking/actionable issues found.

Full-solution test was attempted earlier but did not complete in this local session. Local index refresh is also currently blocked by existing issue #2744.

Documentation and Changelog

• Updated README.md and DEVELOPER_GUIDE.md for cdidx doctor.
• Added changelog fragments:
  • changelog.d/unreleased/1449.security.md
  • changelog.d/unreleased/1463.fixed.md
  • changelog.d/unreleased/1632.added.md

Follow-up Candidates

• Existing Full index can stall in symbol extraction and exit with E013_INDEX_EXTRACTION_STALLED #2744 tracks the local full-index stall encountered while refreshing the repository index.

Fixes #1449
Fixes #1463
Fixes #1632