[codex] Sanitize cleanup and private-log diagnostics

[Widthdom]

Summary

• Make private lifecycle-log permission and pruning failures observable through bounded private_log_diagnostic warnings.
• Minimize index/MCP lock metadata and report cleanup failures with sanitized reason-code diagnostics.
• Return sanitized structured changelog cleanup and rollback diagnostics.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release -p:UseSharedCompilation=false --filter "FullyQualifiedName~PrivateLogFile_TrySetPrivatePermissions|FullyQualifiedName~TryStart_WritesPrivateLogDiagnostics|FullyQualifiedName~IndexLock_Acquire_OnPosix_WritesPrivateInfoFile|FullyQualifiedName~IndexLock_Dispose_WhenMetadataCleanupFails|FullyQualifiedName~McpIndexRunLock_TryAcquire_OnPosix_WritesPrivateInfoFile|FullyQualifiedName~McpIndexRunLock_Dispose_WhenInfoCleanupFails|FullyQualifiedName~PrepareConsumedFragmentDeleteFailure|FullyQualifiedName~PrepareRollbackFailureReportsSanitizedDiagnostic|FullyQualifiedName~PrepareFailureBeforeFragmentDeletionRollsBackReleaseFiles"
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet build
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: no blocking/actionable issues found.

Changelog Fragments

• changelog.d/unreleased/3475.fixed.md
• changelog.d/unreleased/3462.fixed.md
• changelog.d/unreleased/3457.fixed.md

Follow-up Issues

• None opened.

Fixes #3475
Fixes #3462
Fixes #3457