Add opt-in AiContextSelectionDiagnostics to selection results
## Summary
Follow up to:
#3586169
Contrib and site debugging today rely on watchdog/`debug_logging` config, which is global, noisy, and can log sensitive task text. We need structured, **opt-in** selection diagnostics on the result object for preview tools, Drush commands, and developer UI — without leaking context content.
**Goal:** When diagnostics are requested, `AiContextSelector::select()` accumulates a structured breakdown and exposes it on `AiContextResult`.
## Solution
**Proposed API:**
- `AiContextRequest::withDiagnostics(bool $enabled = TRUE)` (or equivalent factory/builder opt-in; **default off**)
- New value object: `AiContextSelectionDiagnostics`
- `AiContextResult::getDiagnostics(): ?AiContextSelectionDiagnostics`
**Diagnostics payload (IDs, scores, reason codes only — no rendered text or content snippets):**
- Prefilter candidate count (after scope index)
- Post-load candidate count
- Per-item score breakdown (where applicable)
- Skipped items + reason enum (e.g. token cap, never include, access, hard filter)
- Final token budget used / truncated item IDs
**Non-goals for this issue:**
- Selection preview UI (`/admin/ai/context/selection/preview`) — separate follow-up
- Watchdog replacement for production logging
- Including rendered content or content snippets in diagnostics
**Security / privacy:**
- Never include raw context content in diagnostics
- Do not auto-enable via global config; opt-in per request only
## Acceptance criteria
- Opt-in request returns populated diagnostics; default request returns `null`
- Kernel tests cover at least: empty selection, truncated-by-tokens, skipped-by-access/filter
- Developer docs describe the API and privacy constraints
## Related
- A `selection preview UI` feature could be a follow-up to this work
- Complements selector pipeline events (`#3586162`); does not replace them
## AI usage
- [x] AI assisted issue
- [ ] AI generated code
issue