[patch] Fix build: restore failure, SDK analyzer errors, Spectre.Console API break

[matt-edmondson]

Summary

dotnet build failed at restore on main. Fixing that exposed three further layers of breakage that the early failure had been masking. All four problems were pre-existing; none were introduced by this branch.

Build is now clean with 0 warnings, and all 43 tests pass.

What was broken

1. Restore failure (NU1506)

global.json pins MSTest.Sdk 4.3.3, which injects its own PackageVersion items for MSTest.TestAdapter, MSTest.TestFramework, and Microsoft.Testing.Extensions.CodeCoverage when central package management is on. Directory.Packages.props declared those same three at older versions, so NuGet saw duplicates and failed the restore.

Removed ours and left the SDK to own them, with a comment recording why they must not come back.

2. New ktsu.Sdk 2.16.1 analyzers

The recent bump from 2.15.0 brought two rules that had never run against this repo:

• KTSU0005 flagged 11 orphaned PackageVersion entries. Removed.
• KTSU0006 flagged types used from packages that only arrived transitively. Added explicit PackageReference entries for Spectre.Console.Ansi, ktsu.Semantics.Strings, ktsu.Semantics.Paths, SixLabors.ImageSharp, Microsoft.Extensions.DependencyInjection.Abstractions, and ktsu.AppDataStorage.

3. Spectre.Console API break

Dependabot bumped Spectre.Console 0.55 → 0.56 → 0.57 while Spectre.Console.Cli stayed at 0.55.0. In that pairing, AsyncCommand<T>.ExecuteAsync and Command<T>.Execute are protected and take a CancellationToken, but all 28 command classes still had the old public two-argument signature.

Updated every command, and threaded the token through to ScanAsync, AskAsync, and ConfirmAsync where the analyzers flagged it.

4. Code quality rules as errors

With compilation finally reaching these projects, CA2007, CA1849, CA2016, CA1806, CA1002, IDE0005, and IDE0060 fired. Fixed at source rather than suppressed.

Worth a closer look during review

MergeHistorySettings.Entries changed from List<T> to Collection<T> for CA1002. That type is persisted as JSON, so it is a serialization surface. It round-trips correctly and the history tests pass, but it is the one change here with a data shape attached to it.

MergeCommand gained an unreachable guard. CA1806 objected to a discarded TryParse result. Settings.Validate() already rejects unknown diff styles, so the new branch cannot be hit in practice. I mirrored the existing check in the batch branch rather than discarding the result, and marked it as belt-and-braces in a comment.

Follow-up not in this PR

Spectre.Console.Cli at 0.55.0 against Spectre.Console 0.57.0 is the version skew that caused problem 3. It compiles now, but that pairing is worth aligning if a matching Cli release exists.

Two unrelated items were left out of this branch, both still sitting dirty in the working tree:

• icon.png has shrunk from 16,069 bytes to 130, which looks like a truncated or corrupted file rather than an intentional edit.
• An untracked dev/null/ directory containing git hooks, the Windows artifact of a script redirecting to /dev/null in a non-POSIX shell. Probably wants a .gitignore entry.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
59.3% Coverage on New Code (required ≥ 80%)
6.7% Duplication on New Code (required ≤ 3%)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE