Bound changelog inputs and stage release writes

[Widthdom]

Summary

• Bound changelog fragment, CHANGELOG.md, and version.json reads before parsing.
• Stage prepare writes through temp files, clean failed temp writes, roll back release-file replacements before fragment deletion, and preserve symlinked release-file targets.
• Document changelog tool limits in the fragment workflow and add bilingual changelog fragments for both issues.

Validation

• dotnet build CodeIndex.sln -c Debug -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --commits HEAD --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ChangelogToolTests" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false -maxcpucount:1
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~ChangelogToolTests"
• dotnet run --project tools/CodeIndex.Changelog -c Release -- check
• dotnet run --project tools/CodeIndex.Changelog -c Release -- release-notes --version 1.0.0
• git diff --check origin/main
• Codex adversarial review against origin/main: no blocking/actionable regressions after fixes.

Notes

• Added changelog fragments: changelog.d/unreleased/2909.fixed.md, changelog.d/unreleased/2910.fixed.md.
• Updated .codex/workflows/changelog-fragment.md for the enforced limits.
• Did not modify AGENTS.md, CLAUDE.md, or AGENT_GUIDE.md.
• No additional issues were included, and no new follow-up issue was filed.

Fixes #2909
Fixes #2910