Redact support recovery paths by default

[Widthdom]

Summary

• Redact machine-specific apphost, assembly, source, database, data, and log paths from CLI/MCP recovery metadata and status --config by default.
• Add explicit local --show-paths handling, structured redaction metadata, and safely quoted recovery commands without rewriting rendered shell text.
• Harden SQLite file-URI query sanitization for raw/encoded paths, percent-encoded sensitive keys, mixed path/secret values, option-like source names, Windows drives, and UNC paths.

Root cause

Recovery metadata serialized resolved absolute argv before rendering, while status --config emitted resolved path settings without the same support-safe policy. File-URI query components also required structural decoding and sanitization before safe reconstruction.

Validation

• dotnet build CodeIndex.sln --no-restore (0 warnings, 0 errors)
• Focused Issue Apply support-safe path redaction to recovery commands and status config #4860 / sanitizer / status-config tests on net8.0 and net9.0 (net8: 18 passed; net9: 17 passed, 1 production-runtime skip)
• make lint
• dotnet run --project tools/CodeIndex.Changelog -- check (33 fragments validated)
• Full net9.0 suite: 10,204 passed, 419 skipped
• Full net8.0 suite: 10,676 passed, 7 skipped; existing baseline failure tracked separately
• Two Codex adversarial-review rounds completed; all four P1 findings were fixed with regression coverage and the final reproductions were verified

Documentation and changelog

• Updated the English and Japanese recovery/status contracts in DEVELOPER_GUIDE.md and TESTING_GUIDE.md.
• Added changelog.d/unreleased/4860.security.md.

Related: #4955

Fixes #4860