Make report bundles overwrite-safe, provenance-scoped, and truthful

[Widthdom]

Summary

The report command silently overwrites an existing output, can bundle an unrelated stale global failure from an older cdidx context, and reports db_included:true even when the database is not an archive member.

Audit IDs: O-06, O-08, O-25. Reproduced with cdidx v1.40.3 at 404db09489c305f17d94f37026e00564d3ac527a; one bundle included a v1.10.0 failure unrelated to the current v1.40.3 run.

Expected behavior

Report creation must be non-destructive by default, include only diagnostics whose provenance is relevant and disclosed, and distinguish “database inspected” from “database file included.”

PR scope

One PR should harden the report artifact builder and report manifest. Portable export is tracked separately.

Implementation guide for Codex 5.6 sol xhigh

• Add atomic output creation with explicit --overwrite; preserve the old file on every failure path.
• Define provenance keys for persisted failures (workspace/DB identity, cdidx version, timestamp, command/run ID) and exclude or clearly quarantine records that do not correlate.
• Rename/split db_included into unambiguous inspected/diagnostics/member fields while preserving a documented compatibility path for existing consumers.
• Redact sensitive paths using the shared redaction policy and test stale, cross-workspace, missing-provenance, and current failures.
• Update schema/help/docs, add regression tests, run net8/net9, and add a bilingual changelog fragment.

Acceptance criteria

• Existing reports are never replaced without opt-in.
• An unrelated historical failure is not presented as evidence for the current report.
• The manifest states exactly which files are members and what DB diagnostics were gathered.
• Machine consumers can distinguish excluded/quarantined stale evidence.

[Widthdom]

Work started on branch fix-issue4828.