Release: two-phase dual-publish release model (signed)

.editorconfig

@@ -38,6 +38,11 @@ indent_size = 2
 [*.sh]
 end_of_line = lf
 
+# Husky git hooks are POSIX shell scripts (extensionless) and must be LF so the
+# shebang execs on Linux/WSL; otherwise [*] = crlf would break them.
+[.husky/pre-commit]
+end_of_line = lf
+
 # Windows scripts
 [*.{cmd,bat,ps1}]
 end_of_line = crlf
@@ -48,6 +53,47 @@ end_of_line = crlf
 # Default to suggestion severity
 dotnet_analyzer_diagnostic.severity = suggestion
 
+# AnalysisMode=All (Directory.Build.props) enables every analyzer rule as a
+# build warning, overriding the bulk suggestion default above on a per-rule
+# basis; combined with TreatWarningsAsErrors that breaks the build on existing
+# brownfield code. Relax the specific rules below back to suggestion — each is
+# a deliberate, documented exception rather than a latent defect:
+#   CA1002  Public APIs intentionally expose List<T> (e.g. FileEx.EnumerateDirectory,
+#           StringHistory.StringList); changing to Collection<T> would break the
+#           published InsaneGenius.Utilities surface.
+#   CA1024  Download.GetUri is intentionally a method, not a property.
+#   CA1034  Unavoidable nested types generated by C# 14 `extension` members in
+#           Extensions.cs (the file already suppresses the related CA1708).
+#   CA1054  Download URL parameters are intentionally `string`, not `System.Uri`.
+#   CA1063  Existing IDisposable implementations are intentionally simple.
+#   CA1307  String operations rely on the default comparison; existing behavior
+#           is intentional and unchanged.
+#   CA1515  Library/console/test public types are intentionally public.
+#   CA1823  xUnit fixture fields are injected for lifetime/collection wiring and
+#           are not always referenced directly.
+#   CA1849  A few synchronous calls inside async paths are kept intentionally.
+#   CA2000  Stream/disposable ownership is frequently transferred (returned or
+#           stored), so scope-based disposal analysis reports false positives.
+#   CA2007  Library `await using` / `await foreach` disposal sites; the awaited
+#           async calls already use ConfigureAwait(false), and rewriting the
+#           using-declarations into ConfigureAwait blocks hurts readability.
+#   CA5394  Random is used for retry jitter / temp-name generation, not security.
+# (IL3058 — Serilog not AOT-annotated — is a compiler/linker-level warning with
+# no source location, so it can't be set here; it's handled via NoWarn in the
+# AOT project files instead.)
+dotnet_diagnostic.CA1002.severity = suggestion
+dotnet_diagnostic.CA1024.severity = suggestion
+dotnet_diagnostic.CA1034.severity = suggestion
+dotnet_diagnostic.CA1054.severity = suggestion
+dotnet_diagnostic.CA1063.severity = suggestion
+dotnet_diagnostic.CA1307.severity = suggestion
+dotnet_diagnostic.CA1515.severity = suggestion
+dotnet_diagnostic.CA1823.severity = suggestion
+dotnet_diagnostic.CA1849.severity = suggestion
+dotnet_diagnostic.CA2000.severity = suggestion
+dotnet_diagnostic.CA2007.severity = suggestion
+dotnet_diagnostic.CA5394.severity = suggestion
+
 csharp_indent_block_contents = true
 csharp_indent_braces = false
 csharp_indent_case_contents = true

.github/dependabot.yml

@@ -1,43 +1,72 @@
 # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# Every ecosystem appears **twice**: once with `target-branch: "main"`
+# and once with `target-branch: "develop"`. Dependabot will open
+# parallel PRs against each branch, so both stay current on
+# dependency versions independently of the develop → main release
+# cadence.
+#
+# Why dual-target and not develop-only:
+# - `develop` is the integration branch and ships content forward to
+#   `main` through merge-commit releases, but the time between releases
+#   can be long (a feature branch may sit on develop for weeks).
+# - Consumers (NuGet.org, GitHub releases) pull from `main` directly.
+#   If `main` only got dependency bumps via the next develop → main
+#   release, those consumers would ship outdated code in the interim.
+#
+# The merge-bot's `case` statement in
+# .github/workflows/merge-bot-pull-request.yml dispatches the merge
+# method per base ref (squash on develop, merge on main) so both bases
+# auto-merge cleanly. `develop` remains strictly forward-only: there
+# are no main → develop back-merges; each branch absorbs its own
+# Dependabot PRs independently.
+#
+# Security update PRs (CVE-driven) are opened by Dependabot against
+# the repo default branch (`main`) regardless of any `target-branch`
+# config — the `case` statement handles them in the same code path.
 version: 2
 updates:
 
-  # main
-- package-ecosystem: "nuget"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    nuget-deps:
-      patterns:
-        - "*"
-- package-ecosystem: "github-actions"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    actions-deps:
-      patterns:
-        - "*"
+  # ----- nuget -----
 
-  # develop
-- package-ecosystem: "nuget"
-  target-branch: "develop"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    nuget-deps:
-      patterns:
-        - "*"
-- package-ecosystem: "github-actions"
-  target-branch: "develop"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    actions-deps:
-      patterns:
-        - "*"
+  - package-ecosystem: "nuget"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "nuget"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+
+  # ----- github-actions -----
+
+  - package-ecosystem: "github-actions"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"

.github/workflows/build-datebadge-task.yml

@@ -0,0 +1,37 @@
+name: Build BYOB date badge task
+
+on:
+  workflow_call:
+    inputs:
+      # Logical branch this badge run is for. The badge only updates on
+      # `main`; the publisher passes the branch explicitly so a scheduled
+      # run building `develop` doesn't try to write the main badge. Required
+      # (no `github.ref_name` fallback) so the gate can't silently misfire.
+      branch:
+        required: true
+        type: string
+
+jobs:
+
+  date-badge:
+    name: Build BYOB date badge job
+    runs-on: ubuntu-latest
+
+    steps:
+
+      - name: Get current date step
+        id: date
+        run: |
+          set -euo pipefail
+          echo "date=$(date)" >> "$GITHUB_OUTPUT"
+
+      - name: Build BYOB date badge step
+        if: ${{ inputs.branch == 'main' }}
+        uses: RubbaBoy/BYOB@a4919104bc0ec7cfd7f113e42c405cc45246f2a4 # v1
+        with:
+          name: lastbuild
+          label: "Last Build"
+          icon: "github"
+          status: ${{ steps.date.outputs.date }}
+          color: "blue"
+          github_token: ${{ secrets.GITHUB_TOKEN }}