Fix hook timeout and diagnostic sanitizer flakes

[Widthdom]

Summary

• Reject post-extraction hook worker responses when the measured callback elapsed time already exceeds the configured callback budget.
• Widen the slow hook budget test timing margins so full-suite scheduler contention does not make the test boundary ambiguous.
• Make diagnostic sanitization fall back to a generic sanitized message when bounded regex path redaction times out.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~DiagnosticSanitizerTests|FullyQualifiedName~ExtractorPluginRegistryTests.LoadPluginAssemblies_RetainsCapDiagnosticWhenCandidatesAlsoFailToLoad"
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~PostExtractionHookTests.CallbackBudgetExceeded_KillsWorkerAndSkipsTimedOutMutation"
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release -p:UseSharedCompilation=false --filter "FullyQualifiedName~PostExtractionHookTests.CallbackBudgetExceeded_KillsWorkerAndSkipsTimedOutMutation|FullyQualifiedName~DiagnosticSanitizerTests|FullyQualifiedName~ExtractorPluginRegistryTests.LoadPluginAssemblies_RetainsCapDiagnosticWhenCandidatesAlsoFailToLoad"
• dotnet test CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: No blocking/actionable issues found.

Documentation / Changelog

• Added changelog.d/unreleased/3252.fixed.md.
• Added changelog.d/unreleased/3261.fixed.md.
• Added changelog.d/unreleased/3292.fixed.md.

Follow-up Candidates

• None.

Fixes #3261
Fixes #3252
Fixes #3292