Harden portable export artifact publishing

[Widthdom]

Summary

• Refuse existing portable archive destinations unless --overwrite is explicit, create source-bearing archives privately, and publish with platform no-clobber rename primitives plus a safe hard-link fallback.
• Extend successful JSON with final archive byte size, SHA-256, and the complete manifest carrying counts, schema contract stamps, readiness state, and scope while preserving existing fields.
• Cover regular and dangling-symlink refusal, explicit overwrite, permissions, failed-write cleanup, concurrent creation, artifact verification, help/completion, and human-output hashing behavior.

Validation

• dotnet restore CodeIndex.sln
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-restore (0 warnings, 0 errors; rerun after final review follow-up)
• dotnet test CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-build before the final no-clobber compatibility follow-up: net8.0 10,479 passed / 7 skipped / 0 failed; net9.0 10,006 passed / 419 skipped / 0 failed
• Post-follow-up focused tests: net8.0 20 passed / 0 failed; net9.0 19 passed / 1 environment skip / 0 failed
• dotnet format CodeIndex.sln --verify-no-changes --no-restore --verbosity minimal
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• codex review --base origin/main (two adversarial rounds; all findings addressed)

Documentation

• Updated the English and Japanese portable-export sections in USER_GUIDE.md, DEVELOPER_GUIDE.md, and TESTING_GUIDE.md.
• AGENTS.md, CLAUDE.md, and AGENT_GUIDE.md were not changed.

Changelog

• Added bilingual fragment changelog.d/unreleased/4827.security.md.

Follow-ups

• None.

Fixes #4827