Re-sync from template: add Merge Gate, codegen rules, dispatch guard

.editorconfig

@@ -36,7 +36,7 @@ indent_size = 2
 end_of_line = crlf
 indent_size = 2
 
-# Json and JsonC files
+# JSON and JSONC files
 [*.{json,jsonc}]
 end_of_line = crlf
 

.github/dependabot.yml

@@ -1,74 +1,74 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-#
-# Every ecosystem appears **twice**: once with `target-branch: "main"`
-# and once with `target-branch: "develop"`. Dependabot will open
-# parallel PRs against each branch, so both stay current on
-# dependency versions independently of the develop → main release
-# cadence.
-#
-# Why dual-target and not develop-only:
-# - `develop` is the integration branch and ships content forward to
-#   `main` through merge-commit releases, but the time between releases
-#   can be long (a feature branch may sit on develop for weeks).
-# - Consumers (NuGet.org, GitHub releases) pull from `main` directly.
-#   If `main` only got dependency bumps via the next develop → main
-#   release, those consumers would ship outdated code in the interim.
-# - The codegen workflow takes the same dual-target shape for the same
-#   reason — see .github/workflows/run-codegen-pull-request-task.yml.
-#
-# The merge-bot's `case` statement in
-# .github/workflows/merge-bot-pull-request.yml dispatches the merge
-# method per base ref (squash on develop, merge on main) so both bases
-# auto-merge cleanly. `develop` remains strictly forward-only: there
-# are no main → develop back-merges; each branch absorbs its own
-# Dependabot PRs and codegen PRs independently.
-#
-# Security update PRs (CVE-driven) are opened by Dependabot against
-# the repo default branch (`main`) regardless of any `target-branch`
-# config — the `case` statement handles them in the same code path.
-version: 2
-updates:
-
-  # ----- nuget -----
-
-  - package-ecosystem: "nuget"
-    target-branch: "main"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      nuget-deps:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "nuget"
-    target-branch: "develop"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      nuget-deps:
-        patterns:
-          - "*"
-
-  # ----- github-actions -----
-
-  - package-ecosystem: "github-actions"
-    target-branch: "main"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      actions-deps:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "github-actions"
-    target-branch: "develop"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      actions-deps:
-        patterns:
-          - "*"
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# Every ecosystem appears **twice**: once with `target-branch: "main"`
+# and once with `target-branch: "develop"`. Dependabot will open
+# parallel PRs against each branch, so both stay current on
+# dependency versions independently of the develop → main release
+# cadence.
+#
+# Why dual-target and not develop-only:
+# - `develop` is the integration branch and ships content forward to
+#   `main` through merge-commit releases, but the time between releases
+#   can be long (a feature branch may sit on develop for weeks).
+# - Consumers (NuGet.org, GitHub releases) pull from `main` directly.
+#   If `main` only got dependency bumps via the next develop → main
+#   release, those consumers would ship outdated code in the interim.
+# - The codegen workflow takes the same dual-target shape for the same
+#   reason — see .github/workflows/run-codegen-pull-request-task.yml.
+#
+# The merge-bot's `case` statement in
+# .github/workflows/merge-bot-pull-request.yml dispatches the merge
+# method per base ref (squash on develop, merge on main) so both bases
+# auto-merge cleanly. `develop` remains strictly forward-only: there
+# are no main → develop back-merges; each branch absorbs its own
+# Dependabot PRs and codegen PRs independently.
+#
+# Security update PRs (CVE-driven) are opened by Dependabot against
+# the repo default branch (`main`) regardless of any `target-branch`
+# config — the `case` statement handles them in the same code path.
+version: 2
+updates:
+
+  # ----- nuget -----
+
+  - package-ecosystem: "nuget"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "nuget"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+
+  # ----- github-actions -----
+
+  - package-ecosystem: "github-actions"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"

.github/workflows/build-datebadge-task.yml

@@ -1,37 +1,37 @@
-name: Build BYOB date badge task
-
-on:
-  workflow_call:
-    inputs:
-      # Logical branch this badge run is for. The badge only updates on
-      # `main`; the publisher passes the branch explicitly so a scheduled
-      # run building `develop` doesn't try to write the main badge. Required
-      # (no `github.ref_name` fallback) so the gate can't silently misfire.
-      branch:
-        required: true
-        type: string
-
-jobs:
-
-  date-badge:
-    name: Build BYOB date badge job
-    runs-on: ubuntu-latest
-
-    steps:
-
-      - name: Get current date step
-        id: date
-        run: |
-          set -euo pipefail
-          echo "date=$(date)" >> $GITHUB_OUTPUT
-
-      - name: Build BYOB date badge step
-        if: ${{ inputs.branch == 'main' }}
-        uses: RubbaBoy/BYOB@a4919104bc0ec7cfd7f113e42c405cc45246f2a4 # v1
-        with:
-          name: lastbuild
-          label: "Last Build"
-          icon: "github"
-          status: ${{ steps.date.outputs.date }}
-          color: "blue"
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+name: Build BYOB date badge task
+
+on:
+  workflow_call:
+    inputs:
+      # Logical branch this badge run is for. The badge only updates on
+      # `main`; the publisher passes the branch explicitly so a scheduled
+      # run building `develop` doesn't try to write the main badge. Required
+      # (no `github.ref_name` fallback) so the gate can't silently misfire.
+      branch:
+        required: true
+        type: string
+
+jobs:
+
+  date-badge:
+    name: Build BYOB date badge job
+    runs-on: ubuntu-latest
+
+    steps:
+
+      - name: Get current date step
+        id: date
+        run: |
+          set -euo pipefail
+          echo "date=$(date)" >> $GITHUB_OUTPUT
+
+      - name: Build BYOB date badge step
+        if: ${{ inputs.branch == 'main' }}
+        uses: RubbaBoy/BYOB@a4919104bc0ec7cfd7f113e42c405cc45246f2a4 # v1
+        with:
+          name: lastbuild
+          label: "Last Build"
+          icon: "github"
+          status: ${{ steps.date.outputs.date }}
+          color: "blue"
+          github_token: ${{ secrets.GITHUB_TOKEN }}