[codex] Classify .NET sync cancellation audit hits

[Widthdom]

Summary

• Removed unnecessary no-token helper wrappers from DiffCommandRunner and ExportImportCommandRunner internals.
• Updated affected export/import tests to call token-aware helpers with an explicit CancellationToken.None.
• Added bilingual documentation classifying the remaining intentional sync/cancellation audit hits and a changelog fragment.

Validation

• dotnet build CodeIndex.sln -c Debug -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --commits HEAD --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll search --recipe dotnet-risk-patterns/cancellation-token-none --audit-scope source --count-by file --total-limit 200 --limit 200
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll search --recipe dotnet-risk-patterns/sync-over-async --audit-scope source --count-by file --total-limit 200 --limit 200
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Debug --filter "FullyQualifiedName~ExportImportCommandRunner" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Debug --filter "FullyQualifiedName~DiffCommandRunnerTests" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• git diff --check
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet format CodeIndex.sln --verify-no-changes

Documentation and changelog

• docs/dotnet-risk-audit-4059.md
• changelog.d/unreleased/4059.fixed.md

Review

Adversarial review of origin/main..HEAD: No blocking/actionable issues found.

Follow-up candidates

None.

Fixes #4059