Harden report bundle provenance and overwrite safety

[Widthdom]

Summary

• refuse existing report output unless --overwrite is explicit and durably restore the old bundle on publication failure
• correlate persisted failures with the effective workspace/database, binary version, timestamp, and run provenance
• list exact archive members and split database inspection, diagnostics, and member fields while retaining the compatibility alias

Root cause

The report writer replaced outputs by default, consumed a process-global last-failure record without enough provenance, and overloaded db_included for database inspection rather than archive membership.

Validation

• dotnet build CodeIndex.sln -c Release --no-restore (0 warnings, 0 errors)
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release -f net8.0 --no-build --no-restore (10,482 passed, 7 skipped)
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release -f net9.0 --no-build --no-restore (10,009 passed, 419 skipped)
• targeted report/atomic tests: 75 passed on net8.0 and net9.0 in Debug and Release
• dotnet format CodeIndex.sln --no-restore --verify-no-changes
• dotnet run --project tools/CodeIndex.Changelog -- check
• Codex adversarial review (2/2): first pass found two DB-selection/provenance parser issues; second pass found four rollback durability, indexed-project provenance, path-casing identity, and JSON error-code issues; all fixed with regressions

Changelog

• changelog.d/unreleased/4828.security.md

Fixes #4828