Harden repository-configured output paths

[Widthdom]

Summary

• Reject repository-configured metrics and global-log paths that cross symbolic links, junctions, reparse points, devices or special files, cross-device mounts, or same-device bind mounts.
• Bind guarded POSIX and Windows writes, directory creation, permission changes, rotation, replacement, and deletion to native workspace-root handles, including mutation-time parent rebinding and Windows physical-root retention.
• Guard lifecycle logs, query traces, metrics, and last-failure.json, with a bounded unsafe_output_path diagnostic and a Linux mount-ID fallback for systems where statx does not expose that identity.
• Add cross-platform alias, race, mount, FIFO, durability, case-normalization, and root-retargeting coverage.

Validation

• Debug and Release solution builds: 0 warnings, 0 errors.
• Issue Reject config output paths that escape through symlink ancestors #5181 tests: 30/30 on net8.0 and net9.0.
• Related configuration/logging/metrics tests: 133/133 on net8.0 and net9.0 in Debug and Release.
• dotnet format CodeIndex.sln --no-restore --verify-no-changes.
• dotnet run --project tools/CodeIndex.Changelog -- check (Validated 2 changelog fragment(s).).
• git diff --check.
• Local repository index and both workspace members are current, complete, and healthy.
• Codex adversarial review: all earlier findings addressed; final review reported no blocking or actionable defects and independently passed the related 133 tests on both target frameworks.
• An earlier full Release sweep passed 11,931 tests with 9 skipped on net8.0. The net9.0 lane passed 11,448 tests with 428 skipped and had one unrelated timing assertion failure; that unchanged test passed standalone from the same binaries.

Documentation and changelog

• Updated the English and Japanese sections of DEVELOPER_GUIDE.md and USER_GUIDE.md.
• Added the bilingual fragment changelog.d/unreleased/5181.security.md; CHANGELOG.md is unchanged.

Follow-up candidates

• None.

Fixes #5181