Fix search origin filters, guard scope, and guarded candidate handling

[Widthdom]

Summary

• Add --origin as an alias for --match-origin and support repeatable --exclude-origin filters.
• Make catch audit recipes require code-origin matches and expose recipe facet metadata.
• Add --guard-scope same-line / MCP guardScope and report guard scope in JSON evidence/checks.
• Stream guarded search filtering while reading ranked candidates and add bounded diagnostics for truncated guard/dedup state.

Issues

Fixes #3680
Fixes #3709
Fixes #3730
Fixes #3746

Validation

• dotnet build CodeIndex.sln -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~RunSearch_OriginAliasAndExcludeOriginFilterExactSubstring_Issue3680|FullyQualifiedName~RunSearch_CatchRecipeFiltersCommentOnlyCatchMatches_Issue3709|FullyQualifiedName~RunSearch_GuardScopeSameLineUsesPrimaryMatchColumns_Issue3730|FullyQualifiedName~RunSearch_GuardFiltersKeepRequestedBudgetWithOriginFilters_Issue3423|FullyQualifiedName~RunSearch_ListRecipesJsonIncludesBuiltInAuditMetadata_Issue3144|FullyQualifiedName~ParseArgs_ParsesSearchGuardFlags_Issue2852|FullyQualifiedName~SearchUsageLineListsGuardFlags_Issue2852" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• git diff --check origin/main..HEAD
• dotnet test CodeIndex.sln -p:UseSharedCompilation=false passed before merging latest origin/main; the post-merge rerun was interrupted after 25+ minutes without failures but before the final summary.

Review

Adversarial review: No blocking/actionable issues found.