Fix workspace discovery and diagnostic status hardening

[Widthdom]

Summary

• Use the explicit project root for workspace plugin and pattern discovery, including scan-time custom pattern loading and status graph-language reporting.
• Report post-extraction hook candidates in status through metadata-only discovery so status does not load hook assemblies.
• Sanitize plugin, hook, and pattern-config diagnostics before they surface through status or index warnings.

Validation

• dotnet build CodeIndex.sln -p:UseSharedCompilation=false
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet run --project tools/CodeIndex.Changelog -- check
• Focused dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --no-build --filter "FullyQualifiedName~ScanFiles_LoadsProjectRootPatternConfigsBeforeLanguageDetection_3190|FullyQualifiedName~ExtractorPluginRegistryTests|FullyQualifiedName~PostExtractionHookTests|FullyQualifiedName~RunStatus_Json_ReportsHookCandidatesWithoutLoadingAssemblies_3142|FullyQualifiedName~EnumeratePluginAssemblyPaths_UsesExplicitProjectRootForWorkspacePlugins"
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --commits HEAD --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: No blocking/actionable issues found.

A full-suite run was attempted during development but did not produce a clean bounded summary in this local environment, so the focused regression set above is the reliable local test signal for this PR.

Documentation And Changelog

• Updated README.md, DEVELOPER_GUIDE.md, and AGENT_GUIDE.md status/extensibility contract notes.
• Added changelog fragments:
  • changelog.d/unreleased/3143-3190.fixed.md
  • changelog.d/unreleased/3142.fixed.md
  • changelog.d/unreleased/3240.security.md
  • changelog.d/unreleased/3243.security.md

Follow-Up Candidates

None.

Fixes #3143
Fixes #3190
Fixes #3142
Fixes #3240
Fixes #3243