Harden upgrade and update release downloads

[Widthdom]

Summary

• Pin cdidx upgrade installer downloads to the resolved GitHub release tag instead of mutable main.
• Bound installer and update-check HTTP response bodies, keep explicit timeouts active through body reads, and create installer temp scripts with owner-only POSIX permissions.
• Add changelog fragments for Pin or verify install script used by cdidx upgrade #2816, Bound and privately write installer downloads during upgrade #2875, and Update checker should bound GitHub release response before JSON parsing #2907.

Validation

• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~BoundedHttpContentReaderTests|FullyQualifiedName~ProgramRunnerTests.BuildInstallerScriptUrl|FullyQualifiedName~ProgramRunnerTests.DownloadInstallerScriptAsync_CancelsStalledBody|FullyQualifiedName~ProgramRunnerTests.UpdateChecker_ReadLatestReleaseTagAsync|FullyQualifiedName~ProgramRunnerTests.UpdateChecker_FetchLatestReleaseTagAsync_CancelsStalledBody" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• codex exec --ephemeral --sandbox read-only "Follow .codex/workflows/adversarial-review.md..." -> No blocking/actionable issues found.

Scope

• Work-start comments were absent when the issues were checked, so Pin or verify install script used by cdidx upgrade #2816, Bound and privately write installer downloads during upgrade #2875, and Update checker should bound GitHub release response before JSON parsing #2907 were all handled.
• No additional follow-up issue was created.

Fixes #2816
Fixes #2875
Fixes #2907