registry: mark MediaTools conformant - #262

…spec/registry updates (#267)

Promotion of `develop` -> `main`, batching the merged PRs since the last
promotion:

- **#266** — merge-bot auto-merges every Dependabot tier (drop
semver-major skip) + docs.
- **#265** — WORKFLOW.md D1.4 correction (workflow changes are linted in
CI).
- **#264** — canonical WORKFLOW.md EOL note + repo-config JSON indent.
- **#263** — spec: CODECOV_TOKEN for csharp/python repos + coverage
policy.
- **#262** — registry: mark MediaTools conformant.
- **#261** — codify general repository settings + promotion-safety
learnings.

No code beyond template governance/config/spec; `spec/validate.py`
green.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

… TFM (#4109)

## Summary

Implements the hub side of #4103. Every fleet .NET repo selects its SDK
line in `global.json`, and the C# version follows the TFM rather than
the installed compiler.

- **`dotnet-codestyle` Skill**, "Central build and package
configuration":
- `global.json` is required, with an `sdk` block (`10.0.100`,
`rollForward: latestFeature`, `allowPrerelease: false`). The `test`
runner key appears only where the test project is MTP-based.
- `LangVersion` is left unset in props files and in every project
targeting a .NET TFM. A `netstandard` analyzer or source-generator
project may set a fixed number, since unset it compiles at C# 7.3, which
`Nullable` `enable` refuses.
- `latest`, `latestMajor`, and `preview` are banned everywhere.
`AnalysisLevel` stays `latest-all`.
- The skill states the host requirement and the drift conditions, and
says a major move starts in the hub's `setup-dotnet` steps.
- **`references/testing.md` and `references/project-config.md`** point
at that rule.
- **`CODESTYLE.md` .NET summary** names the rule, so the new check's
`intentRef` lands on it.
- **Audit:** a new `csharp.sdk.globaljson` letter check in
`spec/project-types.json`, and `global.json` in the csharp type's
`requiredFiles`.
- **Baseline:** a hub snippet `catalog/snippets/configs/global.json`
(the `sdk` block only) and its `spec/files.json` entry, so standup and
the presence audit carry the file.
- The generated `.github/skills/` and `.claude-plugin/` copies are
regenerated.

Follow-ups filed rather than done here: #4106 (the Linux installer
installs only the newest SDK line by default) and #4107 (the hub's
`setup-dotnet` steps read `global.json` once every .NET repo carries
it).

The shape matches what the PhotoCleaner #262 change verified under SDK
10.0.404 and 11.0.100.

Part of #4103. The closing keyword belongs on the develop -> main
promotion.

## Open Findings From the Local Pass

- `.agents/skills/dotnet-codestyle/SKILL.md:121` (`introduced`): the
netstandard exception sits between "Those float with the installed SDK's
compiler." and the IDE0028/CS8652 sentence that explains it. That
sentence then reads as a result of the fixed number. The edit budget was
spent, so it was fixed in this pull request's review loop, in 9fd565e,
with its own recorded pass (no findings).

- `spec/project-types.json:9` (`introduced`), raised by the local pass
on b953e56: the csharp type's `requiredFiles` lists only
`.editorconfig` and `.gitattributes`, while the new check makes a root
`global.json` required for every C# repo. That push's edit budget was
spent, so it was fixed in the next push (requiredFiles, then the snippet
and baseline entry below).

## Declined Findings From the Local Pass

- A multi-targeting library (`netstandard2.0;net10.0`, or
`net8.0;net10.0`), or a netstandard library that is not an analyzer, has
no LangVersion instruction it can follow. Declined under `GOVERNANCE.md`
"Trust Boundaries and Hardening Effort": no fleet repo multi-targets,
and the only netstandard project in the fleet is an analyzer. A repo
that adds one is the moment to extend the rule.

## Review Follow-Ups

- The Copilot finding on the LangVersion scope was fixed in 0d54f2f.
The local pass on that fix also tightened the check: the version must be
the `100` band, a `global.json` with no `sdk` block is drift, and the
check's sentences were shortened.
- A TFM major move keeps the old SDK line installed in the hub's steps
until every repo has moved (b953e56). That ordering point is also noted
on #4107.

- The local passes on the follow-up pushes also made the version exactly
`<major>.0.100` rather than any 1xx band, scoped the LangVersion rule to
files the repo holds (the SDK's own targets set it), banned
`EnablePreviewFeatures`, named the devcontainer image as a second
SDK-line site, and moved a netstandard project's fixed `LangVersion`
with the TFM. The last pass on the head found nothing.

## Verification

- `scripts/build_dist.py --check`: generated skill distributions are
current.
- `scripts/prose_lint.py --diff origin/develop`: no violations.
- `spec/validate.py`: OK.
- `markdownlint-cli2` on the changed Markdown: 0 issues.
- Full `pytest tests/` on the head: 4009 passed, 11 skipped.
- `scripts/repo_gate.py`: all checks ok.
- Four recorded `local-strict-review` passes: six findings fixed in
round one, one in round two, one listed above and fixed, and a clean
pass on that fix.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>