Fix watch cancellation, membership, and startup reconciliation

[Widthdom]

Summary

• propagate top-level watch cancellation through active extraction, FTS, planner maintenance, scoped output capture, and long-lived MCP disposal without overriding the second-Ctrl-C force-exit contract
• unify watch membership with FileIndexer, observe ancestor ignore rules, refresh extractor generations, and re-extract unchanged retained sources after extractor configuration changes
• load workspace plugin assemblies without retaining Windows file locks so extractor refresh can delete or replace them
• close the startup watcher handoff deterministically and emit watching only after every startup reconciliation sub-run succeeds
• add bilingual user/developer documentation and per-issue changelog fragments

Validation

• dotnet build CodeIndex.sln -c Release --no-restore (0 warnings, 0 errors)
• issue regression groups: 23 passed on net8.0 and 23 passed on net9.0
• post-origin/main extractor-registry and Use one membership and invalidation policy for scan, status, and watch #4592 regression group: 51 passed on net8.0 and 51 passed on net9.0
• full Release net8.0: 9,570 passed, 6 skipped, 0 failed
• full Release net9.0: 9,132 passed, 386 skipped, 0 failed
• dotnet format CodeIndex.sln --no-restore --verify-no-changes
• dotnet run --project tools/CodeIndex.Changelog -- check (65 fragments validated after the latest merge)
• git diff --check
• two Codex adversarial review loops completed; all actionable findings addressed

Documentation and changelog

• changelog.d/unreleased/4591.fixed.md
• changelog.d/unreleased/4592.fixed.md
• changelog.d/unreleased/4594.fixed.md
• bilingual user/developer documentation updated for the changed watch contracts

Related

An earlier net9.0 full-suite run observed the known console-contamination cancellation flake tracked by #4625 and #4650; its exact standalone rerun passed, and the final full-suite rerun above was clean.

Fixes #4591
Fixes #4592
Fixes #4594