Release 1.5: branch-scoped self-publishing CI/CD

.editorconfig

@@ -52,15 +52,14 @@ end_of_line = lf
 [*.{cmd,bat,ps1}]
 end_of_line = crlf
 
-# --- .NET-only below: C# and ReSharper style. Everything above is the line-ending
-# governance every derived repo carries; a non-.NET repo may drop from here down. ---
+# --- .NET-only below: C# and ReSharper style. Everything above is line-ending governance. ---
 
 # C# files
 [*.cs]
 end_of_line = crlf
 # Suppressions follow CODESTYLE.md "Analyzer Diagnostics and Suppressions": prefer a
-# [SuppressMessage] attribute or the owning project's .editorconfig; relax a rule
-# repo-wide here only when it applies to every project (never a brownfield batch).
+# [SuppressMessage] attribute or the owning project's .editorconfig, and relax a rule
+# repo-wide here only when it applies to every project, never as a batch.
 dotnet_diagnostic.IDE0055.severity = none
 dotnet_analyzer_diagnostic.severity = suggestion
 csharp_indent_block_contents = true

.github/copilot-instructions.md

@@ -4,7 +4,7 @@ Repository conventions for GitHub Copilot (and any other AI agent reading this f
 
 The **canonical guide is [AGENTS.md](../AGENTS.md)** at the repo root - read it first, including the [PR Review Etiquette](../AGENTS.md#pr-review-etiquette) review-loop contract this file's runbook implements. This file is intentionally narrow: commit/PR-title conventions (summarized inline so VS Code's commit-message and PR-title generators have them) plus the GitHub Copilot Review Runbook.
 
-For code-style rules, see [`CODESTYLE.md`](../CODESTYLE.md) at the repo root - one guide with a General section plus the .NET language section.
+For code-style rules, see [`CODESTYLE.md`](../CODESTYLE.md) at the repo root - one guide with a General section and the .NET section.
 
 Do not duplicate language-specific rules here. **Project-specific conventions and API/behavioral contracts also belong in [AGENTS.md](../AGENTS.md), not here** - this file is intentionally limited to the inline commit/PR-title summary and the GitHub Copilot Review Runbook. Non-Copilot agents (Claude Code, Codex, Cursor, ...) are not directed to this file and don't read it by default, so any rule a reviewer must honor has to live in `AGENTS.md` to be provider-independent.
 
@@ -142,13 +142,11 @@ Issue-level Copilot comments (those in `issues/<N>/comments`) have no resolution
 Reply-body conventions:
 
 - Accepted bug/style fix: include fixing commit SHA and a one-line summary.
-- Declined style comment: cite the rule (AGENTS.md or the CODESTYLE.md language section) and the existing-tree precedent.
+- Declined style comment: cite the rule (AGENTS.md or the CODESTYLE.md .NET section) and the existing-tree precedent.
 - Declined architecture proposal: one-sentence rationale.
 
 After the final push, sweep-resolve stale older threads for removed code paths.
 
 ## When in Doubt
 
-Read [AGENTS.md](../AGENTS.md) for this repo's conventions. For code-style rules, [`CODESTYLE.md`](../CODESTYLE.md) (its General section plus the relevant language section) is authoritative. Don't restate any of these files' rules in commit bodies or PR descriptions - keep those focused on the change itself.
-
-**In a derived repo:** if you find a discrepancy that should be fixed in the template itself (this file or AGENTS.md is out of date, a rule is missing, something bit this repo and would bite the next), open an issue upstream in [`ptr727/ProjectTemplate`](https://github.com/ptr727/ProjectTemplate) rather than only fixing it locally - see the template's [AGENTS.md "Staying in Sync and Reporting Drift Upstream"](https://github.com/ptr727/ProjectTemplate/blob/main/AGENTS.md#staying-in-sync-and-reporting-drift-upstream).
+Read [AGENTS.md](../AGENTS.md) for this repo's conventions. For code-style rules, [`CODESTYLE.md`](../CODESTYLE.md) (its General and .NET sections) is authoritative. Don't restate any of these files' rules in commit bodies or PR descriptions - keep those focused on the change itself.

.github/dependabot.yml

@@ -1,31 +1,14 @@
 # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 #
-# Every ecosystem appears **twice**: once with `target-branch: "main"`
-# and once with `target-branch: "develop"`. Dependabot will open
-# parallel PRs against each branch, so both stay current on
-# dependency versions independently of the develop → main release
-# cadence.
+# Every ecosystem is listed twice, target-branch main and develop, so Dependabot opens parallel PRs that keep
+# both branches current independently. main is listed because consumers (NuGet.org, GitHub releases) pull from
+# it directly, and the develop -> main release gap can be long, so main must not wait for a promotion to get its
+# dependency bumps. The codegen workflow takes the same dual-target shape for the same reason.
 #
-# Why dual-target and not develop-only:
-# - `develop` is the integration branch and ships content forward to
-#   `main` through merge-commit releases, but the time between releases
-#   can be long (a feature branch may sit on develop for weeks).
-# - Consumers (NuGet.org, GitHub releases) pull from `main` directly.
-#   If `main` only got dependency bumps via the next develop → main
-#   release, those consumers would ship outdated code in the interim.
-# - The codegen workflow takes the same dual-target shape for the same
-#   reason — see .github/workflows/run-codegen-pull-request-task.yml.
-#
-# The merge-bot's `case` statement in
-# .github/workflows/merge-bot-pull-request.yml dispatches the merge
-# method per base ref (squash on develop, merge on main) so both bases
-# auto-merge cleanly. `develop` remains strictly forward-only: there
-# are no main → develop back-merges; each branch absorbs its own
-# Dependabot PRs and codegen PRs independently.
-#
-# Security update PRs (CVE-driven) are opened by Dependabot against
-# the repo default branch (`main`) regardless of any `target-branch`
-# config — the `case` statement handles them in the same code path.
+# The merge-bot (.github/workflows/merge-bot-pull-request.yml) picks the merge method per base (squash on
+# develop, merge on main) and auto-merges both. develop is forward-only: no main -> develop back-merges, each
+# branch absorbs its own bot PRs. Dependabot opens CVE security PRs against the default branch (main) whatever
+# the target-branch, and the merge-bot handles them in the same path.
 version: 2
 updates: