Isolate worker hooks and proxy credentials

[Widthdom]

Summary

• Isolate symbol extraction worker test controls from ambient environment variables and remove the worker completion-path write.
• Gate default OS proxy credential forwarding for GitHub issue submission and duplicate preflight behind an explicit opt-in environment variable.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~IndexCommandRunnerTests|FullyQualifiedName~GitHubIssueReporterTests|FullyQualifiedName~IssueDuplicatePreflightTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~SymbolExtractionWorker_TimeoutKillsWorkerBeforeDelayedExtractionContinues|FullyQualifiedName~SymbolExtractionWorker_LegacyEnvironmentHooksAreIgnored_Issue3398|FullyQualifiedName~SymbolExtractionWorker_CapturesStdoutAndForwardsStderrDiagnostics|FullyQualifiedName~SymbolExtractionWorker_StartInfo_BoundsInternalTestDelay_Issue3398|FullyQualifiedName~ShouldUseDefaultProxyCredentials_IsExplicitOptIn_Issue3369" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ShouldUseDefaultProxyCredentials_IsExplicitOptIn_Issue3369" -p:UseSharedCompilation=false --no-restore
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-restore
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Documentation and Changelog

• Updated USER_GUIDE.md with the explicit proxy credential opt-in.
• Added changelog.d/unreleased/3398.security.md.
• Added changelog.d/unreleased/3369.security.md.

Review

• Codex adversarial review: No blocking/actionable issues found.

Fixes #3398
Fixes #3369