Bound lifecycle log collection work

[Widthdom]

Summary

• Keep cdidx report lifecycle log-tail collection to a bounded recent-file candidate set instead of sorting/materializing every stderr-*.log file.
• Cap best-effort private log permission hardening during startup.
• Prune private logs with a bounded retained-file set, then stream-delete older files without sorting/materializing all matches.

Validation

• dotnet build CodeIndex.sln -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ReportCommandRunnerTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~GlobalToolLogTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~McpServerTests.ProcessLineAsync_CapsTelemetryArgumentKeyCount_Issue3237" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Full-suite note: dotnet test CodeIndex.sln -p:UseSharedCompilation=false produced one unrelated MCP telemetry test failure during this work; the targeted rerun passed and the follow-up is tracked in #3325.

Documentation / Changelog

• Added changelog.d/unreleased/3026.fixed.md.
• Added changelog.d/unreleased/3027.fixed.md.
• Added changelog.d/unreleased/3028.fixed.md.
• Updated USER_GUIDE.md and generated report README text to document the 32-file report log-tail candidate cap.
• No CHANGELOG.md edit; this uses the unreleased fragment workflow.

Review

Adversarial review found that the new report log-tail candidate cap was not documented in generated/user-facing report text. That was fixed in the #3026 commit; no remaining blocking/actionable issues were found.

codex exec review --base origin/main --ephemeral was attempted, but the nested review could not complete because its internal repository-read/tool calls failed repeatedly. A read-only Codex adversarial review followed .codex/workflows/adversarial-review.md against origin/main..HEAD.

Follow-up

• Full test suite can fail MCP telemetry cap test with duplicate event match #3325

Fixes #3026
Fixes #3027
Fixes #3028