Bound CLI diagnostic and trace output

[Widthdom]

Summary

• Bound long CLI diagnostic values for doctor output, query default environment parse errors, query trace parameters, and persistent stderr log mirrors.
• Sanitize active-workspace and .cdidx-version load warnings so raw paths and provider exception messages are not printed by default.
• Add focused regression tests and changelog fragments for the handled issues.

Changelog

• changelog.d/unreleased/3109.security.md
• changelog.d/unreleased/3110.security.md
• changelog.d/unreleased/3123.security.md
• changelog.d/unreleased/3164.security.md
• changelog.d/unreleased/3166.security.md
• changelog.d/unreleased/3218.security.md
• changelog.d/unreleased/3219.security.md

Validation

• dotnet format CodeIndex.sln --verify-no-changes
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~ProgramRunnerTests|FullyQualifiedName~WorkspaceCommandRunnerTests|FullyQualifiedName~GlobalToolLogTests|FullyQualifiedName~QueryCommandRunnerMaxLineWidthTests"
• dotnet tools/CodeIndex.Changelog/bin/Release/net8.0/CodeIndex.Changelog.dll check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Full-suite note: dotnet test CodeIndex.sln -c Release --no-build passed on net9.0; net8.0 hit an unrelated transient DiagnosticSanitizer regex timeout tracked in DiagnosticSanitizer can time out while sanitizing plugin registry diagnostics #3292, and the failing test passed when rerun alone.
• Adversarial review: No blocking/actionable issues found.

Related

• DiagnosticSanitizer can time out while sanitizing plugin registry diagnostics #3292

Fixes #3109
Fixes #3110
Fixes #3123
Fixes #3164
Fixes #3166
Fixes #3218
Fixes #3219