Add path-redacted portable export archives

[Widthdom]

Summary

• add opt-in cdidx export <archive> --redact-paths support while preserving default export compatibility
• scrub source-machine roots, absolute scope selectors, and flat/grouped persisted path samples only in the copied SQLite snapshot, with one final vacuum before hashing
• preserve fail-closed workspace-verification trust when pending-path identities are redacted, and reject inconsistent completed-redaction claims during import
• keep redacted human and JSON success output free of resolved archive/database/source paths

Validation

• Debug build: 0 warnings, 0 errors
• Release build: 0 warnings, 0 errors
• Issue regression tests: 6/6 passed on net8.0 and 6/6 passed on net9.0
• Related export/import, CLI schema/help, console UI, and documentation drift tests: 405/405 passed on net8.0 and 405/405 passed on net9.0
• dotnet format CodeIndex.sln --no-restore --verify-no-changes
• changelog validator: 16 fragments validated
• refreshed the repository index at HEAD: 1,468 files, 56,291 symbols, 524,013 references, 0 warnings/errors
• root status --check matched the workspace; workspace status reported both members healthy

Documentation / changelog

• updated the English and Japanese sections of USER_GUIDE.md, DEVELOPER_GUIDE.md, and TESTING_GUIDE.md
• added/updated changelog.d/unreleased/5195.security.md

Adversarial review

• completed the two workflow review rounds against origin/main..HEAD
• resolved the first-round findings covering grouped samples, malformed/oversize metadata, and duplicate scoped-export vacuuming
• resolved the second-round findings covering whitespace-wrapped absolute selectors, pending-path trust demotion, import verification of redaction claims, and filesystem-aware exact-case project selection

Follow-up candidates

• None.

Fixes #5195