Represent clean named queries separately from stale queries

[Widthdom]

Summary

Fresh TODO/FIXME/HACK/XXX named queries with zero matches appear under query_freshness.stale_query_names, conflating clean results with invalid/stale query state.

Audit IDs: R-10. Reproduced with locally built cdidx v1.40.3 at 404db09489c305f17d94f37026e00564d3ac527a.

Existing issue relationship

Closed #4312 is adjacent query freshness/audit metadata work.

Expected behavior and PR scope

Freshness is independent from match count. Model clean zero-match, matched, and genuinely stale/invalid states separately. Keep this to recipe/query freshness accounting.

Implementation guide for Codex 5.6 sol xhigh

• Derive freshness from index/recipe/query version and execution validity, not result cardinality.
• Add structured clean/zero-match fields while preserving compatibility for old consumers.
• Cover clean zero, matches, missing query, changed recipe, stale index, failed child, and mixed recipe runs.
• Align text, JSON, SARIF/issue-draft metadata where freshness is surfaced.
• Add focused positive/negative regression tests, run the full net8.0 and net9.0 suite, and add the required bilingual changelog.d/unreleased/ fragment.

Acceptance criteria

• Zero clean matches are never called stale.
• Stale is reserved for real freshness invalidation.
• Mixed query summaries reconcile counts/states.