Harden update checks, duplicate preflight, and upgrade diagnostics

[Widthdom]

Summary

This PR handles the requested issue set only:

• Hardened upgrade diagnostics: constrained explicit release tags, bounded suppressed installer output tails in JSON failures, sanitized install-directory probe diagnostics, and explicit installer checksum trust-boundary fields.
• Hardened update-check behavior: shared GitHub HTTP policy, gated cache diagnostics, cache TTL preservation on failed/null probes, cache-root validation, and bounded rate-limit retry metadata.
• Hardened GitHub duplicate preflight: cancellable async GitHub loading, sanitized diagnostics, bounded rate-limit metadata, and duplicate confidence/signals from safe body/evidence-path matching.
• Replaced remaining runtime timestamp reads in the touched CLI/MCP/GitHub flows with injectable clocks.

Validation

• dotnet build src/CodeIndex/CodeIndex.csproj --framework net8.0 -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 --no-build --filter FullyQualifiedName~IssueDuplicatePreflightTests (11 passed)
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 --no-build --filter FullyQualifiedName~Suggestions_ExportIssueDrafts (6 passed)
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 --no-build --filter FullyQualifiedName~IssueDrafts (8 passed)
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 -p:UseSharedCompilation=false (7918 passed, 7 skipped)
• dotnet run --project tools/CodeIndex.Changelog -- check
• git diff --check origin/main..HEAD

Notes

No third-party work-start comments were present on the requested issues when work began, so all requested issues were included. No AGENT.md, CLAUDE.md, or AGENT_GUIDE.md files were edited.

Fixes #3831
Fixes #3823
Fixes #3822
Fixes #3750
Fixes #3708
Fixes #3700