status --check stays stale after changed-between refresh

[Widthdom]

Summary

After a successful cdidx index . --changed-between <old> <new> --json, status --check --json can still report the index as stale even though the file contents and indexed_head_sha match the workspace HEAD.

This looks like a regression or adjacent case to closed #2473.

Observed

On branch codex/code-search-audit at b9ac272c7b5fa501be07458899524552852dbf2d:

1. dotnet build
2. dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json reported stale because the DB was indexed at 04314618a3532dac6264d0cd24a4aef7ffb21917.
3. dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --changed-between 04314618a3532dac6264d0cd24a4aef7ffb21917 b9ac272c7b5fa501be07458899524552852dbf2d --json succeeded and updated 3 files.
4. status --check --json still exited non-zero with index_matches_workspace:false, reason:"head_changed", indexed_head_sha:"b9ac272...", but workspace_check.indexed_head_commit:"04314618...".

Expected

After a successful git-aware changed-between refresh with no remaining file mismatches, status --check should either treat the index as fresh or explain why another refresh mode is required using consistent HEAD fields.

Impact

Agents following AGENT_GUIDE.md are forced into a full rebuild even after a successful delta refresh, which slows the self-improvement loop and makes freshness diagnostics confusing.

[Widthdom]

Work started on branch fix-issue2917-2808.

[Widthdom]

I could not reproduce the stale status --check --json result on latest origin/main from branch fix-issue2917-2808.

Reproduction attempted:

1. Built the current source with dotnet build CodeIndex.sln -p:UseSharedCompilation=false.
2. Refreshed the workspace index with dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --changed-between 1d96a0305fd72288e176124348814cf79999f8c0 HEAD --json.
3. Ran dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json.

Actual result: exit code 0, index_matches_workspace:true, workspace_check.matches_workspace:true, and workspace_check.reason:"matched". I will add issue-linked regression coverage in the PR so this behavior remains pinned.