[codex] Reject escaping DbPathResolver sample paths

[Widthdom]

Summary

• Hardened DbPathResolver explicit .cdidx/codeindex.db sample probing so DB-stored sample paths are normalized and must stay under each candidate root before any filesystem read.
• Preserved platform path semantics: Windows-style separators are handled on Windows, while POSIX backslash filenames remain literal.
• Added regressions for ../ escaping samples, rooted samples, Windows drive/UNC samples, and POSIX backslash filenames.

Root Cause

CountMatchingSamples combined a candidate root with untrusted files.path values from the candidate DB and read the resulting path without first proving the normalized path stayed under that root.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~DbPathResolverTests"
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review round 1 found a POSIX backslash regression; fixed in the follow-up commit.
• Codex adversarial review round 2: No blocking/actionable issues found.

Documentation / Changelog

• Added changelog.d/unreleased/2866.security.md.
• No README/user-guide change was needed because this does not change CLI flags, output shape, or documented user workflow.

Follow-up Candidates

None.

Fixes #2866