Make safety audits operation- and polarity-aware

[Widthdom]

Summary

• classify static Regex audit matches by member semantics and suppress only proven BCL Regex.Escape/Regex.Unescape
• classify UseShellExecute assignments by polarity and suppress only direct literal false
• retain unsafe and unresolved findings across aliases, source-defined receivers, legacy identity data, comments/strings, multiline/computed values, and saturated candidate sets

Validation

• Release build for net8.0/net9.0: 0 warnings, 0 errors
• full net8.0 suite: 11,062 passed, 7 skipped, 0 failed
• full net9.0 suite: 10,587 passed, 420 skipped; existing Avoid overhead that makes parallel batch slower than sequential #4872 timed out once under full-suite load and passed on isolated rerun
• focused and related audit tests passed on net8.0/net9.0
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• changelog fragment validation (88 fragments)
• fresh HEAD index and dogfood shell/bare-Regex/qualified-Regex audits (0 findings)
• Codex adversarial review rounds 1 and 2; all actionable findings fixed

Documentation and changelog

• updated the English and Japanese sections of USER_GUIDE.md and TESTING_GUIDE.md
• added changelog.d/unreleased/4911.fixed.md

Fixes #4911