Cap CLI safety limits for issue batch

[Widthdom]

Summary

• Add bounded limits for index --commits, status --stale-after, index --watch --debounce, index --max-symbols-per-file, diff --limit, and DB checkpoint names.
• Update CLI help, completion/docs where relevant, and add one changelog fragment per issue.
• Keep commits split by issue.

Validation

• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet build
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~Issue3177|FullyQualifiedName~Issue3176|FullyQualifiedName~Issue3173|FullyQualifiedName~Issue3172|FullyQualifiedName~Issue3162|FullyQualifiedName~Issue3124|FullyQualifiedName~ConsoleUiTests.PrintUsage_WithoutBanner_HidesAsciiArtAndEasterEggFlags"
• Full dotnet test passed before the final commit-history rebuild; the final tree was verified identical to that tested tree.
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Review

• Adversarial review of origin/main..HEAD: no blocking/actionable issues found.
• codex review --base origin/main was also attempted, but the separate reviewer process could not complete because its internal MCP/shell tool calls failed.

Fixes #3177
Fixes #3176
Fixes #3173
Fixes #3172
Fixes #3162
Fixes #3124