Sanitize LSP JSON-RPC error messages

[Widthdom]

Summary

• Return stable LSP JSON-RPC error messages for invalid params and internal failures instead of forwarding raw exception text.
• Add LSP regression coverage for invalid-params and internal-failure responses.
• Add changelog fragment changelog.d/unreleased/3200.security.md.

Validation

• dotnet build
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~LspServerTests"
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~PostExtractionHookTests.CallbackBudgetExceeded_AddsDiagnosticAndSkipsTimedOutMutation"
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Full dotnet test was started and stopped after more than 22 minutes because it had already hit the known unrelated PostExtractionHookTests.CallbackBudgetExceeded_AddsDiagnosticAndSkipsTimedOutMutation full-suite/load-sensitive failure. Existing open tracking issues: #3252, #3261.

Documentation / Changelog

• User-visible LSP error behavior is covered by changelog.d/unreleased/3200.security.md.
• No AGENTS.md, CLAUDE.md, or AGENT_GUIDE.md changes.

Fixes #3200