Fix installer, upgrade, and package normalize diagnostics

[Widthdom]

Summary

• Split the installer into generated modules and added a generation check.
• Added explicit installer verification policy controls with strict fail-closed mode.
• Added upgrade release selection controls and Windows upgrade handoff metadata.
• Added package normalize dry-run, summary, JSON, and continue-on-error diagnostics.
• Rebased onto the current main conflict-free; installer hardening from main was ported into the generated installer modules.

Documentation and changelog

• Updated DEVELOPER_GUIDE.md and USER_GUIDE.md for the affected CLI/install/release behavior.
• Added changelog fragments:
  • changelog.d/unreleased/3498.internal.md
  • changelog.d/unreleased/3502.security.md
  • changelog.d/unreleased/3375.added.md
  • changelog.d/unreleased/3374.added.md
  • changelog.d/unreleased/3553.added.md

Issues

Fixes #3498
Fixes #3502
Fixes #3375
Fixes #3374
Fixes #3553

Verification

• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~InstallScriptTests|FullyQualifiedName~ProgramRunnerTests.RunUpgrade|FullyQualifiedName~ProgramRunnerTests.UpdateChecker_Check_WritesCacheWithPrivateModes_Issue3411|FullyQualifiedName~ProgramRunnerTests.UpdateChecker_ReadLatestPrerelease|FullyQualifiedName~CliFlagSchemaTests.UpgradeFlags|FullyQualifiedName~ConsoleUiTests.UpgradeUsageLine|FullyQualifiedName~ReleaseWorkflowTests.PackageNormalizeCli|FullyQualifiedName~ReleaseWorkflowTests.PackageNormalizer_Rewrites" -p:UseSharedCompilation=false
• dotnet build -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index /Users/widthdom/Projects/mine/cdidx/CodeIndex8th --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Adversarial review was run; the reported base-branch drift and upgrade CLI schema/help/docs drift were addressed before opening this PR.