[codex] Fix regex and logical line denial vectors

[Widthdom]

Summary

• Harden selected built-in reference extraction regex paths by routing match enumeration through bounded helpers and adding timeout-safe instance coverage.
• Replace TypeScript namespace alias qualified-reference regex fanout with a scanner.
• Bound C# import alias signature regexes and cap Python logical reference remap buffers.
• Add changelog fragments for built-in extractor regex execution should use timeout-bounded helpers #3053, TypeScript namespace-alias reference extraction should avoid per-line dynamic regexes #3054, C# import registration should use timeout-bounded regex for alias signatures #3101, and Python logical reference extraction should cap header and statement maps #3141.

Validation

• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release --no-restore --filter "FullyQualifiedName~BoundedRegexTests" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: no blocking/actionable issues found.

Notes

• No changes to AGENT.md, CLAUDE.md, AGENTS.md, or AGENT_GUIDE.md.

Fixes #3053
Fixes #3054
Fixes #3101
Fixes #3141