Fix symlink preflight consistency

[Widthdom]

Summary

• Make --follow-symlinks all dry-run and execution share resolved external file-target handling.
• Bind followed-link reads and metadata to the filesystem identity of the opened handle while preserving MCP authorization on the lexical link path.
• Preserve retarget/source-drift detection for C# and non-C# files, including atomic replacement retry and reauthorization.
• Report dangling symlinks as successful dry-run warnings through warnings_total / warnings.
• Avoid canonical-path filesystem work for the default non-following policy and use native final-path resolution only when links are followed.

Root cause

Dry-run path filtering compared resolved paths against the project root even for all, while C# preflight and content loading could snapshot different path identities. The first correction also exposed a smaller open-time window where a followed link could be retargeted after resolution but before the stream was opened. CI then caught that handle-bound metadata alone no longer retried when the lexical path was atomically replaced after opening; post-read path identity validation now preserves that retry and reauthorization contract.

Validation

• Debug and Release solution builds: 0 warnings / 0 errors
• Full Release suite before final review hardening: net8.0 10,498 passed / 7 skipped / 0 failed; net9.0 10,025 passed / 419 skipped / 0 failed
• Post-CI-fix related Release suite: net8.0 93 passed / 0 failed; net9.0 90 passed / 3 platform skips / 0 failed
• CI-equivalent net8.0 remaining selection: 9,926 passed / 4 skipped / 0 failed
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• changelog fragment validator
• git diff --check origin/main...HEAD
• cdidx status --check --json (index_matches_workspace: true)
• Codex adversarial review: two required rounds completed; all P1/P2 findings were addressed, including lexical authorized-open preservation, non-following fast-path overhead, and opened-handle identity binding for retarget TOCTOU.

Documentation and changelog

• Updated the English and Japanese symlink-policy sections in DEVELOPER_GUIDE.md.
• Added changelog.d/unreleased/4829.fixed.md.

Follow-up candidates

• None.

Fixes #4829