Preserve repository evidence links in suggestions (#5345)

[Widthdom]

Saving an audit suggestion could replace artifacts/full-dogfood-20260912/FINDINGS.md with [REDACTED:high_entropy_token], permanently losing the evidence link. A bounded lexical recognizer now preserves ordinary relative file references, including the original Markdown fragment, through persistence, show, and JSON/Markdown/issue-draft export.

The exception checks complete token boundaries, individual path components, and credential context. Credential redaction runs first, including complete quoted, concatenated, and collection-valued credentials. Opaque components, traversal, absolute paths, URLs, and control-bearing paths do not qualify; enclosing-token checks reject URL/rooted-path suffixes while handling separate quoted JSON evidence values independently. YAML blocks, tags, and anchors after credential names conservatively redact the remainder of that bounded text field. Existing identifier regression controls from #4403 and #4751 remain covered. Previously redacted editable drafts can be repaired only by explicitly supplying the original context through the existing update command, retaining their stable ID.

Validation:

• Release build: zero warnings and errors.
• Focused redactor/store/CLI/reporter regressions: .NET 8 — 392 passed; .NET 9 — 350 passed, 42 expected production-runtime skips.
• CLI add/show/export, quoted-credential and URL/rooted-path controls, and explicit-original recovery verified against isolated temporary stores.
• Formatting, diff whitespace, and changelog fragment checks passed.
• Full Release suite on the final code: .NET 8 — 12,511 passed, 9 skipped; .NET 9 — 12,017 passed, 435 skipped. No failures, errors, timeouts, or aborts. Runtime/platform-specific skips follow the existing test policy.
• Root database and workspace-manifest freshness checks passed after the final commit, with index and reference-graph completeness intact.
• Codex adversarial review: two rounds completed; all five findings addressed and verified with regression tests and direct CLI reproductions.

Updated both language sections of USER_GUIDE.md, DEVELOPER_GUIDE.md, and TESTING_GUIDE.md. Added changelog.d/unreleased/5345.fixed.md; no direct CHANGELOG.md or agent-instruction changes.

Fixes #5345