Harden local log file handling

[Widthdom]

Summary

• create lifecycle, audit, metrics, and query trace logs with owner-only POSIX permissions from the initial append
• bound metrics log growth with rotation and query trace retention with pruning
• document the hardened security defaults and add changelog fragments for each issue

Validation

• dotnet build
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter FullyQualifiedName~GlobalToolLogTests
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter FullyQualifiedName~AuditLogSinkTests
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter FullyQualifiedName~MetricsSinkTests
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter FullyQualifiedName~ProgramRunnerTests
• dotnet test
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: No blocking/actionable issues found.

Changelog

• changelog.d/unreleased/2843.security.md
• changelog.d/unreleased/2854.security.md
• changelog.d/unreleased/2853.security.md
• changelog.d/unreleased/2884.security.md

Fixes #2843
Fixes #2853
Fixes #2854
Fixes #2884