Honor --show-paths in optimize previews

[Widthdom]

Summary

• Apply the shared maintenance path-display policy to successful optimize dry-run human and JSON output.
• Preserve caller-relative database spelling for both the standalone command and the index-command alias, while --show-paths emits the resolved absolute path and internal I/O keeps using the real path.
• Handle blank or whitespace-only alias --db input by reporting the resolved default path instead of an empty diagnostic value.
• Add cross-platform path-policy, lock-output, alias, dry-run immutability, and Windows SQLite pool regression coverage.

Validation

• dotnet build CodeIndex.sln -c Release --no-restore (0 warnings, 0 errors)
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~Issue5193" --no-restore (net8.0: 3 passed; net9.0: 3 passed)
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~IndexCommandRunnerTests.RunOptimizeFts" --no-restore (net8.0: 9 passed; net9.0: 9 passed)
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~CommandErrorWriterTests.MaintenanceClassifier_RedactsPlatformAbsolutePathsUnlessExplicitlyEnabled_Issue4856" --no-restore (net8.0: 5 passed; net9.0: 5 passed)
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet run --project tools/CodeIndex.Changelog -- check
• Root index and workspace status checks are healthy and match HEAD.
• Codex adversarial review: round 1 P2 alias finding fixed; round 2 found no blocking/actionable issues.

Documentation and changelog

• Updated the English and Japanese sections of DEVELOPER_GUIDE.md and TESTING_GUIDE.md.
• Added changelog.d/unreleased/5193.security.md.

Follow-up candidates

• None.

Fixes #5193