Harden isolated worker and extension loading boundaries

[Widthdom]

Summary

• Bound isolated worker stderr/console capture and preserve async protocol line buffering across chunked reads.
• Scrub worker process environments and validate protocol JSON before deserialization.
• Surface sanitized plugin/pattern diagnostics, including pattern timeouts and candidate-limit diagnostics.
• Bound plugin and hook assembly type inspection and unload unretained hook load contexts.
• Resolve the latest main integration build failure tracked in MCP status handler has duplicate requestToken declaration after cancellation update #3858.

Validation

• dotnet build
• dotnet build CodeIndex.sln --configuration Release --no-restore -p:UseSharedCompilation=false
• dotnet test
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --commits HEAD --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Manual adversarial review per .codex/workflows/adversarial-review.md: No blocking/actionable issues found.
• codex exec review --ephemeral --base origin/main was attempted, but did not complete due Codex CLI execution/tool constraints.

Documentation and Changelog

• Added changelog fragments:
  • changelog.d/unreleased/3836.fixed.md
  • changelog.d/unreleased/3759.security.md
  • changelog.d/unreleased/3821.fixed.md
  • changelog.d/unreleased/3790.fixed.md
• No AGENT.md, CLAUDE.md, or AGENT_GUIDE.md changes.

Additional Issue Reference

Refs #3858

Follow-up Candidates

None.

Fixes #3836
Fixes #3759
Fixes #3821
Fixes #3790