[codex] Fix search recipe and export issue workflows

[Widthdom]

Summary

• Apply external search recipe defaults consistently and sanitize duplicate diagnostics from raw recipe source paths.
• Harden recipe/config boundaries, bounded source reads, query-local recipe metadata, and recipe JSON summary/cursor output.
• Add issue-draft triage metadata, evidence paths, duplicate preflight details, richer export metadata, and duplicate-threshold tuning.

Scope Notes

• No requested issue was skipped; Harden project config and external search recipe loading boundaries #3826, Honor external search recipe defaults and sanitize diagnostics #3807, Improve machine-readable search exports and issue-draft confidence controls #3827, Bound recipe JSON output with summaries or cursoring #3667, and Add severity and confidence metadata to issue-draft output #3668 had no comments indicating someone else had started work.
• Included Bound external search recipe file loading #3674 after confirming it was directly related to Harden project config and external search recipe loading boundaries #3826/Honor external search recipe defaults and sanitize diagnostics #3807 and had no work-start comments.
• AGENT.md, CLAUDE.md, and AGENT_GUIDE.md were not modified.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Debug --filter "FullyQualifiedName~RunSearch_ExternalRecipeDefaultsApplyToScope_Issue3807|FullyQualifiedName~RunSearch_ExternalRecipeDuplicateDiagnosticsHideRawSourcePath_Issue3807|FullyQualifiedName~RunSearch_ListRecipesJsonIncludesBuiltInAuditMetadata_Issue3144|FullyQualifiedName~RunSearch_RecipeJsonRunsBuiltInQueries_Issue3144|FullyQualifiedName~RunSearch_ExternalRecipeQueryScopeAndSeverityApply_Issue3826|FullyQualifiedName~RunSearch_ExternalRecipeSourceReadIsBounded_Issues3826_3674|FullyQualifiedName~LoadAndApply_StopsAtRepositoryBoundary_Issue3826|FullyQualifiedName~RunSearch_RecipeCompactJsonEmitsSummaryAndCursor_Issues3392_3667|FullyQualifiedName~RunSearch_RecipeIssueDraftsIncludeLabelsEvidenceAndDuplicatePreflight_Issue3145|FullyQualifiedName~RunSearch_AdHocIssueDraftsUseTitleLabelsAndDuplicatePreflight_Issue3520|FullyQualifiedName~Suggestions_ExportIssueDraftsIncludesEvidenceAndDuplicatePreflight|FullyQualifiedName~RunSearch_FormatSarifEmitsResultsArray|FullyQualifiedName~RunSearch_FormatCsvEmitsDelimitedRows_Issue1941|FullyQualifiedName~RunSearch_AdHocIssueDraftDuplicateThresholdFiltersMatches_Issue3827|FullyQualifiedName~Suggestions_ExportIssueDraftsDuplicateThresholdFiltersMatches_Issue3827|FullyQualifiedName~Suggestions_DuplicateTuningRequiresIssueDraftExport_Issue3827|FullyQualifiedName~PrintUsage_WithoutBanner_HidesAsciiArtAndEasterEggFlags|FullyQualifiedName~PrintUsage_QueryLinesMatchImplementedOptions|FullyQualifiedName~CliFlagSchemaTests"
• dotnet build CodeIndex.sln -c Debug
• dotnet run --project tools/CodeIndex.Changelog -- check
• git diff --check origin/main..HEAD
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll . --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review: No blocking/actionable issues found.

Fixes #3826
Fixes #3807
Fixes #3827
Fixes #3667
Fixes #3668
Fixes #3674