Return structured JSON for ambiguous goto matches

[Widthdom]

Summary

An ambiguous goto --json request exits with human-readable stderr instead of the structured error envelope used by other JSON failures.

This breaks machine consumers precisely when they need candidate-disambiguation guidance.

Reproduced against the fresh repository index with locally built cdidx v1.45.1 at 81861a14c9396cd74190edc91392ab11abfa86f8.

Reproduction

dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll goto RunSearch \
  --db .cdidx/codeindex.db --json

Actual:

Error: goto found 20 matching definitions for 'RunSearch'...
Hint: ...

The command exits 1 and emits no JSON. A zero-match goto --json request does use the structured error path.

Expected behavior

• Every goto --json failure emits one bounded, parseable structured error.
• Ambiguity includes a stable error code, command:"goto", the match count, and bounded narrowing guidance/candidates.
• Human mode retains its useful current diagnostics.
• Machine stdout is not mixed with unstructured human text.

Existing issue relationship

This is a direct regression/residual case of #4319. A comment on that issue records the same ambiguous goto --json plain-text failure while establishing JSON/output-stream boundaries.

Root-cause pointers

• src/CodeIndex/Cli/QueryCommandRunner.Definition.cs:345-353 routes zero matches through WriteJsonOrHuman.
• The ambiguous branch around lines 361-365 writes directly to stderr.

PR scope and implementation guidance

• Route ambiguity through the shared structured command-error writer.
• Preserve the public goto command identity, exit code, redaction, and bounded-output behavior.
• Represent narrowing guidance structurally; do not place pre-serialized JSON inside a text field.
• Bound candidate identities and expose authoritative total/omitted metadata if the list is sampled.
• Keep human rendering derived from the same error facts where practical.
• Do not change match ranking or automatically choose an ambiguous definition in this PR.

Acceptance criteria

• The reproducer emits exactly one valid structured error in JSON mode.
• Zero, one, and many-match paths use consistent command/error identities.
• Candidate/guidance truncation is explicit and bounded.
• Human mode remains actionable.
• No human diagnostic contaminates machine stdout.

Tests, documentation, and changelog

• Add zero/one/many match tests with JSON, human, redacted paths, candidate caps, and byte limits.
• Verify stdout/stderr placement and exit codes.
• Run the complete net8.0 and net9.0 test suites.
• Update the query error/JSON contract documentation.
• Add the required bilingual changelog.d/unreleased/ fragment referencing Audit CLI output stream and JSON contract boundaries #4319.

[Widthdom]

Work started on branch fix-issue5232.