Fix extension load context and hook discovery diagnostics

[Widthdom]

Summary

• Load extractor plugins and post-extraction hook assemblies through custom collectible assembly load contexts instead of AssemblyLoadContext.Default, while preserving shared CodeIndex interface identity.
• Add CDIDX_HOOKS_DIR override safety checks and sanitized accepted/rejected diagnostics.
• Surface bounded hook discovery diagnostics in CLI and MCP status through hook_diagnostics[].

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~RunStatus_Json_ReportsHookDiscoveryLimitDiagnostics_3456|FullyQualifiedName~DocumentationStatusContractTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~DiscoverDefaultMetadata_ReportsAcceptedHooksDirectoryOverride_3415|FullyQualifiedName~DiscoverDefaultMetadata_RejectsMissingHooksDirectoryOverride_3415|FullyQualifiedName~RunStatus_Json_ReportsHookCandidatesWithoutLoadingAssemblies_3142|FullyQualifiedName~RunStatus_Json_ReportsHookDiscoveryLimitDiagnostics_3456" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~LoadPlugin_LoadsExtractorAssemblyInCollectibleContext_3413|FullyQualifiedName~Discover_LoadsHookAssemblyInCollectibleContext_3413|FullyQualifiedName~CallbackWorker_LoadsHookAssemblyInCollectibleContext_3413|FullyQualifiedName~Discover_LoadsHooksAndAllowsSymbolAndReferenceMutation" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ReleaseWorkflowTests.PackageNormalizeCli_JsonContinueOnErrorReportsAggregateSummary" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet build -p:UseSharedCompilation=false
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• git diff --check origin/main..HEAD

Full dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:UseSharedCompilation=false had one non-reproducing net9.0 failure in ReleaseWorkflowTests.PackageNormalizeCli_JsonContinueOnErrorReportsAggregateSummary; the same test passed immediately afterward in isolation on net8.0 and net9.0. The net8.0 full-suite pass reported 7,629 passing tests and 6 skips.

Docs / Changelog

• Updated README.md, DEVELOPER_GUIDE.md, and AGENT_GUIDE.md status/runtime documentation.
• Added changelog fragments:
  • changelog.d/unreleased/3413.security.md
  • changelog.d/unreleased/3415.security.md
  • changelog.d/unreleased/3456.fixed.md

Fixes #3413
Fixes #3415
Fixes #3456