Honor --show-paths in successful optimize dry-run output

[Widthdom]

Summary

optimize --dry-run exposes the fully resolved absolute database path even when --show-paths was not requested.

The maintenance CLI documents --show-paths as the opt-in for resolved local paths, so successful preview output bypasses the privacy boundary already used by maintenance diagnostics and errors.

Environment

• origin/main: c642bc4c3dda4ef659df8e6b699e10f61da3c836
• cdidx v1.44.3, locally built
• full net8.0 and net9.0 suites pass

Reproduction

dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll optimize \
  --dry-run --db .cdidx/codeindex.db --json

Actual JSON includes:

{
  "status": "dry_run",
  "db_path": "/absolute/local/workspace/.cdidx/codeindex.db"
}

Human output similarly prints the resolved absolute DB path. The input was relative and no --show-paths flag was supplied.

Expected behavior

• Default human and JSON preview output uses the shared support-safe path representation.
• --show-paths is required to emit the resolved absolute path.
• Human and machine output make the same disclosure decision.
• Internal file operations continue to use the real absolute path.

Root cause

• src/CodeIndex/Cli/IndexCommandRunner.Maintenance.cs:216-235 carries showPaths and prepares a support-safe error path.
• Error classification uses that policy.
• The successful preview DTO around lines 278-288 assigns DbPath = dbPath directly after normalization has resolved it to an absolute path.
• The human success path uses the same raw path.

Focused PR scope

One PR should:

1. route optimize preview display through the shared maintenance path policy;
2. apply the same representation to human and JSON output;
3. preserve absolute internal paths for operations only;
4. audit preview lock-holder fields for newly introduced path-bearing values;
5. add regression tests and a bilingual changelog fragment.

Non-goals

• Do not change maintenance failure classification or optimize behavior.
• Do not perform maintenance during dry-run.
• Do not change export/import archive semantics.
• Do not broadly redact unrelated diagnostics.

Implementation guidance and cautions

• Reuse the cross-platform path-display policy; do not use slash-based heuristics.
• Preserve a safe user-relative form where that is the established contract, or use the stable redacted placeholder.
• Test Windows drive/UNC and POSIX paths.
• Keep lock-holder and recovery details support-safe unless explicit disclosure is enabled.
• Never pass the redacted representation back into internal database operations.

Required tests

• Relative and absolute --db values with and without --show-paths.
• Human and JSON dry-run output.
• Existing, missing, invalid, and locked DB cases.
• POSIX, drive-letter, and UNC forms.
• Assert DB bytes and write counters remain unchanged.

Acceptance criteria

• Default preview output contains no resolved workspace prefix.
• --show-paths emits the resolved absolute DB path.
• Human and JSON outputs agree.
• Existing maintenance error redaction and dry-run immutability do not regress.

Regression history

#4856 established shared maintenance error classification and required sensitive absolute paths not to leak by default. The successful optimize preview is a residual path that bypasses that completed contract. No newer exact issue was found.