Bound and redact detailed database diffs

[Widthdom]

Summary

• emit deterministic structured records with named fields instead of opaque rows
• redact text and paths by default, with explicit --include-content
• enforce whole-record UTF-8 budgets with stable count, cursor, replay, and staleness metadata
• keep import dry-run comparisons redacted without unusable cursor metadata

Validation

• dotnet restore CodeIndex.sln
• dotnet build CodeIndex.sln -c Release --no-restore (0 warnings, 0 errors)
• focused Release tests: 114 passed on net8.0 and 114 passed on net9.0
• full Release suite: net8.0 10,714 passed / 7 skipped with one unrelated timing failure; net9.0 10,240 passed / 419 skipped with two unrelated timing/synchronization failures; all three failures passed on isolated retry
• dotnet format CodeIndex.sln --verify-no-changes --no-restore
• dotnet run --project tools/CodeIndex.Changelog -- check (33 fragments)
• Codex adversarial review: No blocking/actionable issues found.

Documentation and changelog

• updated the English and Japanese sections in USER_GUIDE.md and TESTING_GUIDE.md
• added changelog.d/unreleased/4859.security.md

Related issues

• Related: Stabilize net8 subproject watcher reconciliation for ancestor .gitignore changes #4955

Fixes #4859