Fix MCP audit request id truncation coverage

[Widthdom]

Summary

• Added MCP audit regression coverage for a JSON-RPC request id that passes validation but exceeds the audit display cap after JSON escaping.
• Clarified the max-valid request-id boundary and the oversized-id rejection audit boundary.
• Added a bilingual changelog fragment for the three duplicate audit test issues.

Validation

• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~McpAuditLogTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:UseSharedCompilation=false
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-restore
• dotnet build CodeIndex.sln -p:UseSharedCompilation=false --no-restore
• Codex adversarial review: No blocking/actionable issues found.

Documentation / Changelog

• Added changelog.d/unreleased/3306-3308.fixed.md.
• No README or developer-guide updates were required because this changes regression coverage only, not runtime behavior or user-facing output.

Issues

Fixes #3306
Fixes #3307
Fixes #3308

Follow-up Candidates

None.