Fix trusted executable resolution for git and worker hosts

[Widthdom]

Summary

• Resolve GitHelper git invocations through restricted absolute executable candidates instead of ambient PATH, including avoiding the macOS /usr/bin/git developer-tools shim.
• Remove worker fallback to PATH-resolved dotnet; isolated symbol and hook workers now require a trusted absolute dotnet host path from the current process or standard system install candidates, and fail with a structured diagnostic when one cannot be resolved.
• Add security changelog fragments for both issues.

Validation

• dotnet build CodeIndex.sln -c Debug -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Debug --no-build --filter FullyQualifiedName~GitHelperTests
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Debug --no-build --filter StartInfo
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Debug --no-build --filter DotnetHostPathResolver
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Debug --no-build --filter FullyQualifiedName~PostExtractionHook
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Debug --no-build --filter FullyQualifiedName~SymbolExtractionWorker
• dotnet test --no-build --filter "FullyQualifiedName~Issue3433|FullyQualifiedName~Issue3455"
• dotnet run --project tools/CodeIndex.Changelog -- check
• git diff --check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: found macOS /usr/bin/git shim risk, fixed it, then reran with No blocking/actionable issues found.

Full suite note: full dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Debug --no-build passed earlier in this branch before the final trusted-path candidate tightening; the final smaller changes were revalidated with the targeted tests and build above.

Fixes #3433
Fixes #3455