Harden cdidx import archive validation

[Widthdom]

Summary

• Parse and validate manifest.json during cdidx import, including format_version, user_version, and database_sha256 checks before installing the database.
• Bound codeindex.db archive extraction by compressed/uncompressed metadata and by stream-copy byte count.
• Document the import validation and size-limit behavior in DEVELOPER_GUIDE.md.
• Release seeded test SQLite handles on Windows so import archive tamper tests can reopen replacement DB files in CI.

Validation

• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 --filter FullyQualifiedName~ProgramCliTests -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 --filter FullyQualifiedName~ExportImportCommandRunnerTests -p:UseSharedCompilation=false
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release --framework net8.0 --filter FullyQualifiedName~ExportImportCommandRunnerTests -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release --framework net8.0 --filter FullyQualifiedName~ProgramCliTests -p:UseSharedCompilation=false
• dotnet build tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:UseSharedCompilation=false -m:1 -nr:false
• Attempted targeted local test rerun for ProgramCliTests.ImportArchive_RejectsDatabaseHashMismatch; local VSTest could not start because this environment denies TcpListener socket bind (SocketException (13): Permission denied).

Documentation and changelog

• DEVELOPER_GUIDE.md
• changelog.d/unreleased/2834.security.md
• changelog.d/unreleased/2835.security.md

Review

• Codex adversarial review was attempted with codex exec review --base origin/main, but the subprocess did not complete because its internal tool calls timed out; the session was stopped after bounded waiting.
• Manual adversarial review of origin/main..HEAD found no blocking/actionable issues after adding the missing documentation updates.
• Manual review of the CI follow-up found the Windows file-lock failure was in test setup, not production import behavior.

Follow-up candidates

• Observed and filed status hotspot_family_ready recommendation does not clear degraded state after index refresh #2917 for a hotspot_family_ready recommended-action mismatch during index refresh.

Fixes #2834
Fixes #2835