[codex] Fix atomic state writes

[Widthdom]

Summary

• Added a shared atomic file writer that writes to a same-directory temp file, flushes to disk, then renames over the target with best-effort temp cleanup.
• Routed small persistent state writes through it: active workspace/private text writes, suggestion store, update-check cache, and scan checkpoints.
• Added focused cleanup coverage and kept the existing suggestion-store atomic write behavior covered.

Documentation and changelog

• Added changelog.d/unreleased/2828.fixed.md.
• No README/guide update: this changes durability of existing state writes, not a CLI flag, command contract, or documented workflow.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~DataDirectorySecurityTests|FullyQualifiedName~SuggestionStoreTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~UpdateChecker"
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet build CodeIndex.sln -p:UseSharedCompilation=false
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: No blocking/actionable issues found.

Full Release test run was attempted with the repository runsettings, but it was not a clean validation signal in this local environment: it produced unrelated extractor/concurrency failures while other CodeIndex worktree test runs were also active, then stalled. Representative failed tests passed when rerun individually.

Follow-up candidates

None.

Fixes #2828