Pin trusted GitHub CLI for upgrade verification

[Widthdom]

Summary

• pin upgrade attestation verification to a canonical, validated absolute GitHub CLI executable
• fail closed for invalid or missing verifiers in strict mode while keeping the compatibility bypass explicitly unverified
• discover versioned Homebrew Cellar binaries without launching symlinks and expose github_cli_executable trust diagnostics in CLI and MCP status

Validation

• dotnet restore CodeIndex.sln
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-restore (0 warnings, 0 errors)
• dotnet test CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-build
  • net8.0: 11,931 passed, 9 skipped, 0 failed
  • net9.0: 11,447 passed, 430 skipped, 0 failed
• final focused resolver, upgrade, status, and Git regression tests
  • net8.0: 79 passed, 0 failed; final semantic-version test set: 8 passed, 0 failed
  • net9.0: 12 passed, 2 expected skips, 0 failed; final semantic-version test set: 6 passed, 2 expected skips, 0 failed
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --no-restore
• two Codex adversarial-review rounds; all four actionable findings were addressed and validated within the workflow review cap

Documentation and changelog

• updated the matching English and Japanese release/security documentation and status-field tables
• updated AGENT_GUIDE.md for the new status contract
• added changelog.d/unreleased/5184.security.md

Follow-ups

• None.

Fixes #5184