Cap MCP request id length

[Widthdom]

Summary

• Cap MCP JSON-RPC string and numeric request ids before response echo, correlation metadata, telemetry, pending-response lookup, and audit serialization retain them.
• Return a bounded id:null invalid-request response for oversized ids, including max_request_id_chars and max_request_id_bytes diagnostics.
• Document the MCP invalid-request contract and add the security changelog fragment.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~Issue3104" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~McpServerTests|FullyQualifiedName~McpAuditLogTests" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release --filter "FullyQualifiedName~McpServerTests|FullyQualifiedName~McpAuditLogTests" -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Documentation And Changelog

• Updated DEVELOPER_GUIDE.md for the MCP invalid_request request-id length contract.
• Added changelog.d/unreleased/3104.security.md.

Review

Adversarial review: No blocking/actionable issues found.

Follow-Up Candidates

None.

Fixes #3104