Fix config, workspace, and project filter diagnostics

[Widthdom]

Summary

• Collect config-file validation diagnostics in one pass and add mcp.rate_limit.bucket_idle_seconds config support.
• Tighten workspace manifest member validation, normalization, deduplication, and manifest discovery errors.
• Expose effective project-filter root diagnostics when CLI/MCP project expansion falls back to the process current directory.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~CdidxConfigFileTests"
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~WorkspaceCommandRunnerTests"
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~Issue3461|FullyQualifiedName~ProjectFilter|FullyQualifiedName~ProjectScope"
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ProjectFilter|FullyQualifiedName~ProjectScope"
• dotnet build
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Full dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj ran to completion but failed the existing trimmed publish test on both target frameworks because this local machine is missing Microsoft.NETCore.App version 10.0.8-servicing.26229.119, required by Microsoft.NET.ILLink.Tasks 10.0.8.

Documentation And Changelog

• Updated USER_GUIDE.md for config validation, MCP rate-limit config, and project-filter diagnostic fields.
• Updated DEVELOPER_GUIDE.md for workspace manifest validation and project-filter fallback diagnostics.
• Added changelog fragments:
  • changelog.d/unreleased/3429.fixed.md
  • changelog.d/unreleased/3432.fixed.md
  • changelog.d/unreleased/3461.fixed.md

Review

Adversarial review completed. No blocking/actionable issues found.

Follow-Ups

None.

Fixes #3429
Fixes #3432
Fixes #3461