Cap pattern config discovery candidates

[Widthdom]

Summary

• Stream pattern config discovery with Directory.EnumerateFiles instead of materializing directory matches.
• Cap .yaml / .yml pattern config candidates at 128 per directory and emit a pattern-directory diagnostic when the cap is reached.
• Update custom language extraction docs and add changelog.d/unreleased/3051.security.md.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --no-restore --filter "FullyQualifiedName~EnumeratePatternConfigPathsFromDirectory|FullyQualifiedName~Extract_ConfiguredPatternYaml"
• dotnet build --no-restore
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet run --project tools/CodeIndex.Changelog --no-restore -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• dotnet test completed before the latest origin/main merge: net8.0 and net9.0 both passed 7003 tests with 5 skips.
• Adversarial review: codex exec review --base origin/main was attempted twice, but the review subcommand could not complete because its internal shell/tool calls failed and then timed out. Manual adversarial review of origin/main..HEAD found no blocking/actionable issues.

Documentation / Changelog

• Updated README.md and DEVELOPER_GUIDE.md.
• Added changelog.d/unreleased/3051.security.md.

Follow-up Candidates

None.

Fixes #3051