Harden cleanup, LSP, workspace, and config validation

[Widthdom]

Summary

• Harden DB checkpoint/restore cleanup and restore payload handling.
• Restrict LSP rootless path trust and bound position reads during file growth.
• Validate active workspace state roots, DB ownership, config-home inputs, and cdidx config scalar/path/numeric values.
• Add unreleased changelog fragments for each issue.

Issues

Fixes #3379
Fixes #3426
Fixes #3430
Fixes #3431
Fixes #3514

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~DbCommandRunnerTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~LspServerTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~WorkspaceCommandRunnerTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~CdidxConfigFileTests" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet build CodeIndex.sln -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Full unfiltered dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:UseSharedCompilation=false was attempted. It passed 7483 tests and skipped 6 per target, but failed the existing published trimmed CLI test because this local machine lacks Microsoft.NETCore.App 10.0.8-servicing.26229.119; tracked separately by #3573.

Adversarial review over origin/main..HEAD: No blocking/actionable issues found.