Fix selected database hardening issues

[Widthdom]

Summary

• Harden legacy schema migration diagnostics, foreign key validation, read-only fallback diagnostics, checkpoint/restore rollback behavior, cleanup target revalidation, and workspace dependency database validation.
• Merge the latest origin/main into the branch and align CI expectations with the current diagnostic-sanitization and status JSON contracts.
• Add issue-scoped regression tests and changelog fragments for each fixed issue.
• Addressed Codex adversarial review findings for checkpoint JSON diagnostics, --workspace-db read-only validation fallback, Validate attached CodeIndex databases before cross-database dependency queries #3737 changelog fragment formatting, and the Build fails on main due duplicate requestToken declaration in MCP status handler #3859 compile fix.

Issues

Fixes #3810
Fixes #3717
Fixes #3832
Fixes #3812
Fixes #3732
Fixes #3737
Fixes #3859

Validation

• Passed: dotnet run --project tools/CodeIndex.Changelog -- check (Validated 86 changelog fragment(s).).
• Passed: dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework net8.0 --filter "FullyQualifiedName~Run_RestoreRollbackFailurePreservesPrimaryFailure_Issue3514|FullyQualifiedName~Run_RestoreRejectsSymlinkedCheckpointSidecar_Issue3812|FullyQualifiedName~RunStatus_JsonOutput_MatchesGolden".
• Passed: dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework net9.0 --filter "FullyQualifiedName~Run_RestoreRollbackFailurePreservesPrimaryFailure_Issue3514|FullyQualifiedName~Run_RestoreRejectsSymlinkedCheckpointSidecar_Issue3812|FullyQualifiedName~RunStatus_JsonOutput_MatchesGolden".
• Passed: dotnet build tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework net8.0.
• Passed: dotnet build tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework net9.0.
• Passed: dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework net8.0 --no-build --filter FullyQualifiedName~ToolsCall_StatusUpdateCheck_UsesRequestCancellationToken_Issue3658.
• Passed: dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework net9.0 --no-build --filter FullyQualifiedName~ToolsCall_StatusUpdateCheck_UsesRequestCancellationToken_Issue3658.
• Passed: dotnet build src/CodeIndex/CodeIndex.csproj --configuration Debug --framework net8.0.
• Passed: dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --json.
• Passed: dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json (index_matches_workspace: true).
• Codex adversarial review completed for the original issue scope and Build fails on main due duplicate requestToken declaration in MCP status handler #3859; latest narrow CI-fix review was attempted but blocked by Codex CLI usage limits before producing findings.