Bound oversized diagnostics across CLI and MCP

[Widthdom]

Summary

• Bound and flatten user-controlled diagnostic values across CLI option parsing, database path errors, MCP rate-limit and keep-alive warnings, batch-row skip warnings, and MAC profile hints.
• Cap did-you-mean matching input before edit-distance work, and warn on invalid CDIDX_NOTIFY before falling back.
• Added issue-scoped bilingual changelog fragments, including 3093.security.md.

No requested issue had an existing work-start comment, so none were skipped. AGENT.md, CLAUDE.md, and AGENT_GUIDE.md were not modified.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:UseSharedCompilation=false --filter "RunDeps_InvalidFormat_FlattensControlCharacters_Issue3092|RunMap_ParseInvalidSections_FlattensControlCharacters_Issue3092|ParseArgs_InvalidPathGlob_FlattensControlCharacters_Issue3092|TryParseStaleAfter_MaxDuration_FlattensControlCharacters_Issue3092"
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet build CodeIndex.sln -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: initial findings were fixed; final follow-up reported No blocking/actionable issues found.

Fixes #3090
Fixes #3091
Fixes #3092
Fixes #3093
Fixes #3094
Fixes #3095
Fixes #3135
Fixes #3181