[codex] Fix regex policy, shell ranges, and TS diagnostics

[Widthdom]

Summary

• Route find --regex through the shared bounded regex policy, add distinct CLI/MCP regex_timeout contracts, and document the runtime error taxonomy.
• Make case-insensitive extractor/reference regexes culture-invariant and lock built-in regexes to the default timeout/backtracking policy.
• Ignore shell heredoc bodies during symbol extraction and keep shell function ranges bounded.
• Preserve TypeScript path alias config read, parse, size, and depth failure categories.

Validation

• dotnet test --filter "FullyQualifiedName~Issue3559|FullyQualifiedName~Issue3516|FullyQualifiedName~Issue3479|FullyQualifiedName~Issue3510|FullyQualifiedName~Issue3438"
• dotnet build
• dotnet run --project tools/CodeIndex.Changelog -- check
• git diff --check origin/main..HEAD
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review found find --regex should distinguish timeouts and use shared regex policy #3559 USER_GUIDE and CLI/MCP contract-test gaps; fixed them before push.

Full dotnet test was attempted; ReleaseWorkflowTests.PackageNormalizeCli_JsonReportsBoundedFriendlyFailure failed outside this diff and the runner later hung. This matches the already-open PackageNormalize telemetry stderr capture follow-up tracked by #3631, so the issue-scoped targeted tests above are the clean test signal for this PR.

Fixes #3559
Fixes #3516
Fixes #3479
Fixes #3510
Fixes #3438