Classify MCP catalog descriptions as non-executable origins

[Widthdom]

Summary

• classify nested, top-level, and concatenated MCP catalog descriptions as schema_description
• prioritize schema context over generic regex-string heuristics, while preserving executable C# matches
• keep schema prose out of executable audit recipe JSON, SARIF, and issue-draft results
• document the regression coverage and add a bilingual changelog fragment

Root cause

MCP tool catalog construction moved from McpToolDefinitions.cs to McpToolCatalog.cs, while origin classification still recognized only the old path and direct description assignments. Top-level CreateToolDefinition descriptions, concatenated segments, and catalog descriptions containing Regex therefore retained executable/string-oriented origins instead of the canonical schema_description origin introduced by #4416.

Validation

• Debug and Release solution builds: 0 warnings, 0 errors
• focused Classify MCP schema descriptions as non-executable audit origins #4864 tests on .NET 8 and .NET 9: pass
• full suite before the conflict-free latest-main merge: .NET 8 — 10,734 passed, 7 skipped, 0 failed; .NET 9 — 10,259 passed, 420 skipped, with only the pre-existing Use one membership and invalidation policy for scan, status, and watch #4592 watcher failure
• dotnet format CodeIndex.sln --no-restore --verify-no-changes: pass
• changelog fragment validation: pass
• local index freshness check: pass
• real-catalog smoke: BCL Regex timeout audit rows resolves only as schema_description; the new HttpClient audit returns only executable C# evidence
• Codex adversarial review: two rounds completed; both actionable P2 findings were fixed and revalidated

Documentation / changelog

• updated the English and Japanese testing guidance
• added changelog.d/unreleased/4864.fixed.md with English and Japanese entries

Fixes #4864