Keep query and status indexed HEAD stamps consistent

[Widthdom]

Summary

• Make query-envelope metadata.indexed_at_head_sha use the latest successful indexed_head_sha, with legacy full-scan fallback only when the latest key is absent.
• Preserve present-NULL semantics and bind regular and bounded envelopes to a validated response generation so rows, HEAD provenance, and bounded cursors cannot drift across concurrent refreshes.
• Cover full, files, commits, changed-between, rollback, legacy, NULL, MCP, bounded, and unbounded concurrency behavior; document the contract in both English and Japanese.

Root cause

Query envelopes read the full-scan-only indexed_head_commit instead of the latest successful indexed_head_sha. A simple value fallback could not distinguish an absent legacy key from a present NULL value, and envelope construction could reread HEAD metadata after the response rows or generation validation had completed.

Validation

• dotnet restore CodeIndex.sln
• dotnet build CodeIndex.sln -c Release --no-restore --nologo — 0 warnings, 0 errors
• dotnet test CodeIndex.sln -c Release --no-build --no-restore — net8.0: 10,637 passed / 7 skipped / 0 failed; net9.0: 10,164 passed / 419 skipped / 0 failed
• JsonEnvelopeWrapperTests — 21/21 passed on both net8.0 and net9.0
• dotnet format CodeIndex.sln --verify-no-changes --no-restore --include src/CodeIndex/Cli/JsonEnvelopeWrapper.cs tests/CodeIndex.Tests/JsonEnvelopeWrapperTests.cs
• dotnet run --project tools/CodeIndex.Changelog -- check — 26 fragments valid
• cdidx index . --commits HEAD --json and cdidx status --check --json — clean, index_matches_workspace: true, no failed checks

Adversarial review

• Codex review round 1 found two P2 snapshot/NULL fallback issues; both were fixed and regression-tested.
• Codex review round 2 found one P2 race in regular unbounded envelopes; it was fixed with pre/post generation validation and deterministic regression tests. The workflow maximum of two review rounds was reached.

Changelog

• changelog.d/unreleased/4854.fixed.md

Follow-up

• backfill-fold can leave NULL folded values after a scoped update #4946 tracks the separately discovered backfill-fold NULL folded-value issue; it is not fixed by this PR.

Fixes #4854