Add a path-redacted mode for portable export archives

[Widthdom]

Summary

Portable export archives always preserve the source machine's absolute project_root in manifest.json, with no redaction or remapping mode.

These archives are intentionally moved between machines or attached to support/review workflows. Local mode 0600 protects the artifact before sharing, but does not prevent disclosure of usernames, organization/customer names, private repository names, or filesystem layout after it is shared.

Environment

• origin/main: c642bc4c3dda4ef659df8e6b699e10f61da3c836
• cdidx v1.44.3, locally built
• full net8.0 and net9.0 suites pass

Reproduction

dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll export \
  /tmp/codeindex-audit.zip \
  --db .cdidx/codeindex.db --overwrite --json

unzip -p /tmp/codeindex-audit.zip manifest.json

The manifest includes a value equivalent to:

{
  "project_root": "/Users/alice/work/private-repository"
}

There is no archive --redact-paths, portable profile, or root-remapping option.

Proposed behavior

Add an opt-in path-redacted archive mode, preferably using the existing --redact-paths vocabulary.

In that mode:

• manifest.json.project_root is omitted, null, or replaced by a documented non-local token;
• the embedded database's indexed root metadata is scrubbed/remapped too;
• other absolute path-bearing manifest/scope fields are handled consistently;
• export JSON reports whether redaction was requested and completed;
• stdout does not re-expose local paths unless explicit path display is enabled.

Keep the current default if compatibility requires it. Any default change must pass the repository's breaking-change gate.

Root cause and evidence

• src/CodeIndex/Cli/ExportImportCommandRunner.Manifest.cs:17-40 reads IndexedProjectRootMetaKey and passes it directly to the manifest.
• ExportImportCommandRunner.Contracts.cs:111-123 serializes it as project_root.
• The archive also embeds the SQLite snapshot, so changing only manifest.json would create a false privacy guarantee if the same absolute root remains in metadata.
• Scoped export fields may contain resolved absolute inputs and must be included in the audit.

Focused PR scope

One PR should:

1. add a documented path-redacted archive option;
2. apply it to both manifest data and the embedded snapshot;
3. audit remaining archive fields for absolute local paths;
4. make import tolerate absent/redacted source roots;
5. report the selected privacy mode in structured output;
6. document default archive contents and add the bilingual changelog fragment.

Non-goals

• Do not encrypt archives.
• Do not redact repository-relative indexed paths.
• Do not remove hashes, schema/readiness, or commit provenance.
• Do not claim redaction while absolute paths remain in the embedded DB.
• Do not mutate the source database.

Implementation guidance and cautions

• Preserve format version 1 if nullable/redacted fields remain backward compatible; otherwise add a compatible reader path.
• Redact the copied snapshot before computing database_sha256.
• Review solution/project selectors, resolved patterns, scope fields, and unknown-extension samples.
• Keep temporary snapshots and final archives private and atomically published.
• Import must derive its destination independently rather than trusting a redacted source root.
• Expose separate path_redaction_requested, path_redaction_complete, and omitted-category metadata.

Required tests

• Default export retains compatibility.
• Redacted export contains no source absolute root in manifest or SQLite metadata.
• Scoped export with absolute solution/project inputs.
• Import and dry-run import of redacted archives.
• Hash validation after snapshot redaction.
• POSIX and Windows path forms.
• Source DB remains byte-for-byte unchanged.
• Private permissions and atomic publication remain intact.

Acceptance criteria

• A redacted archive contains no source-machine absolute project root in either representation.
• Import preserves index/query functionality.
• Source DB is unchanged.
• Structured output truthfully reports redaction completeness.
• Default compatibility and integrity checks remain intact.

Related issues

#4319 covered broader machine-readable output and path-disclosure boundaries but did not add archive-content redaction. No exact issue for portable archive project-root redaction was found.