Consolidate bounded JSON stream and audit-log serialization helpers

[Widthdom]

Found while dogfooding the locally built cdidx on branch codex/search-audit-issues-20260619.

Duplicate check: no open issue found for BoundedJsonUtf8Stream AuditLogSink non seekable stream serialize JsonNode Parse.

Evidence:

• src/CodeIndex/Mcp/McpServer.cs:3970 has a bounded UTF-8 stream shim that rejects seek/read operations.
• src/CodeIndex/Mcp/AuditLogSink.cs:527 has similar stream override behavior for audit-log serialization.
• src/CodeIndex/Mcp/AuditLogSink.cs:699 serializes and then parses JSON back into a JsonNode for truncation handling.

Problem:
The same low-level stream behavior is implemented in multiple places, and audit-log JSON round-tripping makes serialization behavior harder to reason about and test consistently.

Acceptance criteria:

• Share the bounded/non-seekable stream helper or otherwise document why the implementations must differ.
• Add focused tests for unsupported stream operations and byte-limit behavior.
• Avoid unnecessary JSON serialize/parse round-trips in audit-log truncation if a direct representation is practical.

[Widthdom]

Work started on branch fix-issue3683-3690-3681-3689-3715.