Expand risky-code recipes and default audit scope

[Widthdom]

Summary

• Expanded risky-code with dogfooding, C# smell, and security-focused audit queries.
• Added --audit-scope <source|all> for recipe runs and JSON metadata for the effective scope.
• Defaulted recipe runs to source-focused path/exclusion metadata so recipe definitions, docs, changelog text, and tests are suppressed unless --audit-scope all is used.
• Follow-up CI fix: split diagnostic dump upload out of successful test-result artifacts so Windows lanes do not fail after tests have passed.

Validation

• dotnet build CodeIndex.sln -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~RunSearch_Recipe|FullyQualifiedName~RunSearch_ListRecipes|FullyQualifiedName~ParseArgs_ParsesFiltersFlagsAndAcceptsMaxSnippetLines|FullyQualifiedName~PrintUsage_QueryLinesMatchImplementedOptions" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~CliFlagSchemaTests" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Pipeline fix validation: git diff --check; dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Adversarial review: No blocking/actionable issues found.
• Full dotnet test CodeIndex.sln -p:UseSharedCompilation=false was attempted on the final branch and stopped after more than 25 minutes without completion. A prior full-suite attempt in this workspace exposed the local trimmed-publish runtime issue tracked in Trimmed publish test fails when ILLink 10.0.8 requires unavailable .NET 10.0.8 runtime #3571.

Docs / Changelog

• Updated USER_GUIDE.md for recipe scope behavior.
• Added changelog fragment: changelog.d/unreleased/3385.added.md.
• No changelog fragment was added for the CI-only artifact upload fix.

Follow-up

• Trimmed publish test fails when ILLink 10.0.8 requires unavailable .NET 10.0.8 runtime #3571

Fixes #3385
Fixes #3387
Fixes #3390
Fixes #3440
Fixes #3448