Fix CodeQL and SonarCloud findings; exclude generated files from CodeQL

[Malcolmnixon]

Summary

Fixes the CodeQL and SonarCloud findings reported against the repository, and updates .github/codeql-config.yml to stop CodeQL from scanning generated build output.

CodeQL

• Removed useless upcasts (cs/useless-upcast)
• Simplified map/filter foreach loops to LINQ (cs/linq/missed-select, cs/linq/missed-where)
• Added paths-ignore for **/obj/** / **/bin/** (plus a matching query-filter for cs/missed-ternary-operator) so generated XunitAutoGeneratedEntryPoint.cs files are no longer scanned, mirroring the ApiMark repository's config

SonarCloud

• IDE0028: simplified Dictionary field initializers to collection expressions
• CA1873: guarded expensive logging call arguments with ILogger.IsEnabled checks (AgentToolLauncher, GitClient, LoggingSetup, Program)
• CA1859: retyped an internal-only logger factory parameter for improved performance
• S1192: extracted the repeated .github literal to a constant
• S6096 (zip-slip, BLOCKER): hardened PackageZipExtractor's entry extraction with an inline GetFullPath/StartsWith re-verification against the repo root, in addition to the existing SafePathCombine guard
• CA1806: asserted TryParse return values instead of discarding them
• xUnit2033: used Assert.Single's return value instead of re-indexing
• CA1869: cached JsonSerializerOptions instances instead of allocating per call

Testing

• dotnet build succeeds
• dotnet test test/DemaConsulting.AgentControl.Tests — 192/192 passed
• pwsh ./fix.ps1 run with no further changes needed

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

🟡 Changes recommended

Critical package extraction concerns and an unresolved logging allocation issue remain.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This pull request addresses CodeQL and SonarCloud findings, optimizes logging and allocations, and adds package extraction validation.

Changes:

• Excludes generated build output from CodeQL.
• Modernizes production and test code.
• Adds archive path containment checks and logging optimizations.

File summaries

File	Description
test/DemaConsulting.AgentControl.UiTests/TestSupportTypes.cs	Caches JSON serializer options.
test/DemaConsulting.AgentControl.UiTests/TestSettingsWriter.cs	Reuses options and simplifies initialization.
test/DemaConsulting.AgentControl.Tests/Utilities/UtilitiesSubsystemTests.cs	Simplifies cleanup filtering.
test/DemaConsulting.AgentControl.Tests/Logging/LoggingSetupTests.cs	Guards logging arguments.
test/DemaConsulting.AgentControl.Tests/LauncherUI/SelectPackageWindowViewModelTests.cs	Uses the Assert.Single result.
test/DemaConsulting.AgentControl.Tests/LauncherUI/RepoCardViewModelTests.cs	Simplifies assertions and typing.
test/DemaConsulting.AgentControl.Tests/LauncherUI/MainWindowViewModelTests.cs	Uses returned single elements.
test/DemaConsulting.AgentControl.Tests/AgentPackageManagement/PackageVersionTests.cs	Asserts parsing results.
src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs	Adds extraction containment validation.
src/DemaConsulting.AgentControl/Program.cs	Guards startup logging.
src/DemaConsulting.AgentControl/Logging/LoggingSetup.cs	Narrows factory typing and guards logging.
src/DemaConsulting.AgentControl/LauncherUI/SelectPackageWindow.axaml.cs	Simplifies dialog result handling.
src/DemaConsulting.AgentControl/LauncherUI/MainWindowViewModel.cs	Simplifies card creation.
src/DemaConsulting.AgentControl/GitIntegration/GitClient.cs	Adds conditional diagnostic logging.
src/DemaConsulting.AgentControl/GitIntegration/CommittedAgentFilesCache.cs	Uses collection expressions.
src/DemaConsulting.AgentControl/AgentToolLauncher/AgentToolLauncher.cs	Avoids unnecessary log argument construction.
src/DemaConsulting.AgentControl/AgentPackageManagement/PackageVersionCache.cs	Uses collection expressions.
src/DemaConsulting.AgentControl/AgentPackageManagement/PackageSource.cs	Simplifies filename projection.
.github/codeql-config.yml	Excludes generated build output from CodeQL.

Review details

Suppressed comments (1)

src/DemaConsulting.AgentControl/GitIntegration/GitClient.cs:372

• The new IsEnabled(LogLevel.Debug) guard does not avoid the expensive work it is intended to protect: argumentsText is still built unconditionally immediately before this block. Thus every successful Git invocation allocates the joined argument string even when neither Debug nor Information logging is enabled. Make the string construction lazy and evaluate it only for enabled log paths or the failure path.

        if (_logger.IsEnabled(LogLevel.Debug))
        {
            _logger.LogDebug(
                "Starting git process '{GitExecutable}' with arguments '{Arguments}' in working directory '{WorkingDirectory}'",
                _gitExecutablePath, argumentsText, repositoryPath);
        }

• Files reviewed: 19/19 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Critical build and package-extraction findings remain unresolved, along with logging improvements.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (4)

Previously missed (1) — in code that hasn't changed since the last review.

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:317

• The managed-folder boundary is checked before normalizing the entry path. A zip entry such as .github/agents/../../outside.txt passes this prefix test, and SafePathCombine still accepts it because the resulting path remains under repoRoot, allowing extraction outside the four managed folders. Canonicalize the path before checking the managed-folder boundary, then retain the repo-root containment check.

src/DemaConsulting.AgentControl/AgentToolLauncher/AgentToolLauncher.cs:162

• With the application's MinimumLevel.Debug() configuration, both the Debug and Information checks are enabled during a normal launch, so this change calls string.Join separately in each logging block. A successful launch now formats the same argument list twice instead of once; compute the text once when either level is enabled and reuse it.

            if (effectiveLogger.IsEnabled(LogLevel.Information))
            {
                effectiveLogger.LogInformation(
                    "Started shell process '{FileName} {Arguments}' as PID {ProcessId} after {ElapsedMilliseconds}ms",
                    startInfo.FileName, string.Join(' ', startInfo.ArgumentList), process.Id, stopwatch.ElapsedMilliseconds);

src/DemaConsulting.AgentControl/GitIntegration/GitClient.cs:411

• This failed-process warning also unconditionally evaluates argumentsText.Value, so the expensive argument formatting still occurs when warning logs are filtered out. Add an IsEnabled(LogLevel.Warning) guard around this call to complete the logging optimization.

                _logger.LogWarning(
                    "git process '{GitExecutable} {Arguments}' failed with exit code {ExitCode}; stderr: {StandardError}",
                    _gitExecutablePath, argumentsText.Value, process.ExitCode, stderr);

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:268

• The new reparse-point protection is security-critical, but PackageZipExtractorTests only exercise ordinary extraction and do not verify that a symlink/junction ancestor is rejected (or that extraction cannot write through it). Add a platform-appropriate regression test for this guard before relying on it for the zip-slip finding.

            EnsureNoSymlinkAncestors(Path.GetFullPath(repoRoot), destinationDirectory, entry.FullName);

            Directory.CreateDirectory(destinationDirectory);
        }

        entry.ExtractToFile(destinationPath, overwrite: true);

• Files reviewed: 19/19 changed files
• Comments generated: 3
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Unresolved package-extraction path and reparse-point safety findings remain, including one critical issue.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:269

• This guard runs only after Extract has already blind-deleted all four managed folders. If .github is a junction/reparse point whose target contains agents (or another managed folder), DeleteManagedFolder can resolve through that link and recursively delete content outside the repository before this check throws. Validate the managed-folder ancestors before the deletion phase as well, and cover a populated link target in the regression test.

            EnsureNoSymlinkAncestors(Path.GetFullPath(repoRoot), destinationDirectory, entry.FullName);

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:246

• SafePathCombine also throws ArgumentException for malformed or unsupported path syntax, not only when the canonical path escapes repoRoot (see PathHelpers.SafePathCombine). This catch therefore reports some invalid zip entries as if they escaped the repository and hides the actual cause; use an error message that covers invalid destination paths and preserves the underlying message.

        catch (ArgumentException ex)
        {
            throw new InvalidOperationException(
                $"Zip entry '{entry.FullName}' resolves outside the repository root.", ex);

• Files reviewed: 20/20 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Unresolved ZIP extraction security findings affect root, dangling, and nested reparse points, along with invalid-path error reporting.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:315

• Directory.Exists returns false for a dangling directory symlink/junction, so this condition skips the ReparsePoint check when .github points to a currently nonexistent target. Directory.CreateDirectory(destinationDirectory) can then follow that link and create the extracted files outside repoRoot; inspect the directory entry's attributes directly (handling genuinely missing paths) rather than using Directory.Exists as the gate, and add a dangling-link regression test.

            if (Directory.Exists(current) && File.GetAttributes(current).HasFlag(FileAttributes.ReparsePoint))

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:255

• This catch handles every ArgumentException from path combination, including malformed entry names or other invalid-path failures, but the new message says each case resolved outside the repository root. That produces a false diagnosis for invalid zip entries; either distinguish traversal from invalid-path errors or make the message cover both causes.

        catch (ArgumentException ex)
        {
            throw new InvalidOperationException(
                $"Zip entry '{entry.FullName}' resolves outside the repository root.", ex);

• Files reviewed: 22/22 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

A critical reparse-point bypass remains, and dangling-link protection lacks regression coverage.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:370

• The new File.GetAttributes/not-found handling is intended to preserve the reparse-point check for dangling links, but the added tests cover only junctions whose targets exist. Add a regression test with a dangling symlink/junction and assert extraction refuses it; otherwise this security case can regress back to the former Directory.Exists bypass without detection.

            FileAttributes attributes;
            try
            {
                attributes = File.GetAttributes(current);
            }
            catch (Exception ex) when (ex is FileNotFoundException or DirectoryNotFoundException)

• Files reviewed: 22/22 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Unresolved critical extraction-safety and moderate logging findings block approval.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (5)

docs/design/agent-control/repo-sync/package-zip-extractor.md:66

• The updated sentence says all listed failures wrap underlying I/O exceptions and name the zip/repo paths, but reparse-point checks throw InvalidOperationException directly from EnsureNoSymlinkAncestors/DeleteDirectoryRejectingReparsePoints, and invalid-entry paths use an entry-specific message. Distinguish the wrapped archive/I/O failures from direct validation and reparse-point rejections so this design contract matches the implementation.

a symlink/junction — wrapping the underlying `IOException`/`UnauthorizedAccessException`/
`InvalidDataException` with a message naming the zip path and repo root. The symlink check

docs/reqstream/agent-control/repo-sync/package-zip-extractor.yaml:41

• These two linked tests are Windows-only: each exits via Assert.Skip when !OperatingSystem.IsWindows() (see PackageZipExtractorTests.cs:236-240 and :516-519). This requirement link is unfiltered, so ReqStream does not constrain its evidence to Windows; .github/standards/reqstream-usage.md:113-125 requires windows@... for platform-specific tests, as used throughout the existing requirements. Prefix both links with windows@.

          - PackageZipExtractor_AllManagedFoldersExist_AncestorIsJunctionWithRealFolders_ReturnsFalse
          - PackageZipExtractor_AllManagedFoldersExist_ManagedFolderItselfIsJunction_ReturnsFalse

src/DemaConsulting.AgentControl/AgentToolLauncher/AgentToolLauncher.cs:182

• The failure path still forces argumentsText.Value before LogError even when error logging is disabled. A failed launch with a logger filtered above Error therefore still performs the expensive string.Join, so the CA1873 mitigation is incomplete; guard this logging call with IsEnabled(LogLevel.Error) before reading the lazy value, while retaining the value read needed for the thrown exception message.

                startInfo.FileName, argumentsText.Value, stopwatch.ElapsedMilliseconds, ex.NativeErrorCode);

src/DemaConsulting.AgentControl/GitIntegration/GitClient.cs:430

• The failure path still forces argumentsText.Value before LogError even when error logging is disabled. A failed git invocation with a logger filtered above Error therefore still performs the expensive string.Join, leaving the CA1873 mitigation incomplete; guard this logging call with IsEnabled(LogLevel.Error) before reading the lazy value, without removing the value read needed for the exception message.

                _gitExecutablePath, argumentsText.Value, stopwatch.ElapsedMilliseconds, nativeErrorCode);

test/DemaConsulting.AgentControl.Tests/RepoSync/PackageZipExtractorTests.cs:314

• The cross-platform test only covers a dangling link; all real-target ancestor, root, and nested-link cases skip on Linux/macOS and therefore never exercise ordinary symbolic-link metadata or deletion behavior on those runners. Add at least one real-target Directory.CreateSymbolicLink regression for the non-Windows path instead of relying solely on Windows junctions.

        if (!OperatingSystem.IsWindows())
        {
            Assert.Skip("Directory junctions are a Windows-only filesystem feature.");

• Files reviewed: 24/24 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Unresolved critical repository-safety findings remain in launch preflight and extraction cleanup.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (6)

docs/design/agent-control/repo-sync/package-zip-extractor.md:79

• The implementation uses DeleteDirectoryTree, which recursively enumerates files/directories and calls Directory.Delete(..., recursive: false); it does not perform a plain recursive delete. This description is therefore inaccurate and makes the two-phase safety guarantee harder to verify.

*before* deleting anything, then performs a plain recursive delete — this two-phase split avoids

docs/design/agent-control/utilities/path-helpers.md:11

• This expands PathHelpers from lexical SafePathCombine to filesystem-aware reparse-point queries, but the authoritative docs/sysml2/model/agent-control/utilities/path-helpers.sysml:3 still describes only a safe path-combination utility. The SysML2 modeling standard requires the model to stay synchronized when a unit changes; update that part definition so model queries and rendered structure do not understate the unit's responsibility.

`PathHelpers` is a static utility class providing path-safety primitives with two
complementary halves: `SafePathCombine` performs purely lexical (string-level) containment
validation, while `FindReparsePointInAncestry` and `FindReparsePointInDescendants` perform
filesystem-aware detection of reparse points (symlinks/junctions) that a lexical check alone
cannot see. Callers that assemble a path and then act on the filesystem at it should normally

docs/reqstream/agent-control/launcher-ui/repo-card-view-model.yaml:100

• Adding this exception without amending the preceding AgentControl-RepoCardViewModel-EnsureSyncedBeforeLaunch requirement leaves contradictory requirements: that requirement still says launch must never be prevented and every failed re-extraction is non-blocking, while this one says unsafe reparse failures block it. Update the existing requirement, justification, and evidence to explicitly exclude the unsafe-state case so ReqStream does not report simultaneous compliance obligations.

      - id: AgentControl-RepoCardViewModel-Launch-UnsafeState
        title: >-
          The RepoCardViewModel class shall refuse to launch the configured agent tool,
          raising an error instead, when the ensure-synced-before-launch sync attempt detects
          that a managed agent-file folder is reachable only through a reparse point
          (symlink/junction).

docs/reqstream/agent-control/repo-sync/package-zip-extractor.yaml:31

• This requirement hard-codes UnsafeRepositoryStateException and the internal reparse-point terminology into the requirement itself. .github/standards/requirements-principles.md requires requirements to state observable WHAT, not implementation details such as exception types or algorithms; keep the security behavior in the requirement and describe the exception/guard in the design instead.

          The PackageZipExtractor class shall refuse to extract into, or delete through, a
          managed folder that is reachable only through a reparse point (symlink/junction) -
          whether the repo root itself, an ancestor of a managed folder, the managed folder
          itself, or a directory nested inside it - throwing UnsafeRepositoryStateException
          and leaving the affected content untouched.

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:316

• This branch also reports junctions, not only symbolic links (FileAttributes.ReparsePoint covers both), so calling the offender a "symlinked directory" is inaccurate on Windows where the new regression tests create junctions. Use neutral "reparse-point directory" wording so the security diagnostic identifies the actual class of blocked state.

            throw new UnsafeRepositoryStateException(
                $"'{context}' contains a symlinked directory '{reparsePoint}'; refusing to delete through it.");

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:446

• This message is emitted for junctions as well as symbolic links, but only says "symlinked directory". Because the failure is a security stop and the Windows tests exercise junctions, describe it as a reparse-point directory (or explicitly mention both) to avoid misleading diagnostics.

            throw new UnsafeRepositoryStateException(
                $"'{context}' resolves through a symlinked directory '{reparsePoint}'.");

• Files reviewed: 37/37 changed files
• Comments generated: 3
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings affect unsafe launch and extraction behavior.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

src/DemaConsulting.AgentControl/LauncherUI/RepoCardViewModel.cs:710

• The new hard-stop is not reached for every unsafe repository. AllManagedFoldersExist returns false for a reparse-point path, but EnsureAgentFilesSyncedBeforeLaunch can return before Extract when no package is pinned, committed agent files are reported, no package source is configured, or the pinned package is unavailable. In those cases no UnsafeRepositoryStateException is thrown and Launch proceeds against the linked .github tree, defeating the security policy. Validate reparse-point safety before those early exits (and cover these cases), or propagate an unsafe result from the existence check.

        catch (UnsafeRepositoryStateException)
        {
            // Deliberately not absorbed into the best-effort false/ErrorOccurred pattern below -
            // Launch must treat this as a hard stop, not a "launching anyway" warning.
            throw;

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:319

• This preflight is performed once per managed folder, while Extract invokes DeleteManagedFolder sequentially for all four folders. If an earlier folder is ordinary and a later folder contains a nested reparse point, the earlier folder is permanently deleted before this throws UnsafeRepositoryStateException; extraction then stops with a partially destroyed sync. Preflight all four managed trees before the first delete, and cover a later-folder link case.

    private static void DeleteDirectoryRejectingReparsePoints(string directoryPath, string context)
    {
        var reparsePoint = PathHelpers.FindReparsePointInDescendants(directoryPath);
        if (reparsePoint is not null)
        {
            throw new UnsafeRepositoryStateException(
                $"'{context}' contains a symlinked directory '{reparsePoint}'; refusing to delete through it.");
        }

        DeleteDirectoryTree(directoryPath);

src/DemaConsulting.AgentControl/Utilities/PathHelpers.cs:35

• These new filesystem-aware APIs extend PathHelpers beyond lexical path combination, but the authoritative SysML unit description still says PathHelpers is only a safe path-combination utility (docs/sysml2/model/agent-control/utilities/path-helpers.sysml:3). That leaves the architecture model inconsistent with this source and the updated design/requirements/verification companions; update the model description and lint it with the change.

/// <remarks>
///     Combines two complementary halves of path safety: <see cref="SafePathCombine"/> is purely
///     lexical (string-level containment, no file-system I/O), while
///     <see cref="FindReparsePointInAncestry"/>/<see cref="FindReparsePointInDescendants"/> are
///     filesystem-aware (detecting symlinks/junctions that a lexical check alone cannot see).
///     Callers that assemble a path and then touch the filesystem at it should normally use both:
///     first <see cref="SafePathCombine"/> to reject a textually-escaping path, then one of the
///     reparse-point finders to reject a link that would otherwise redirect an apparently-safe
///     path outside its intended root.
/// </remarks>

• Files reviewed: 37/37 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Archive extraction can still allow launch after failed synchronization, and logging changes add avoidable allocations.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

src/DemaConsulting.AgentControl/AgentToolLauncher/AgentToolLauncher.cs:146

• Lazy<string> allocates a Lazy and a capturing delegate on every launch. The previous implementation already joined ArgumentList once and reused the string, so the stated benefit of avoiding a second formatting pass does not apply; when Information/Debug logging is enabled this adds allocation overhead to every process launch. Compute the text only in an enabled log or failure path, with a local nullable cache if reuse is required.

        var argumentsText = new Lazy<string>(() => string.Join(' ', startInfo.ArgumentList));

src/DemaConsulting.AgentControl/GitIntegration/GitClient.cs:367

• Lazy<string> allocates a Lazy plus a capturing delegate on every Git invocation. The previous code already called string.Join exactly once and reused that result for all log statements, so this does not avoid duplicate formatting; with the production logger's Debug level enabled, it adds allocations to the hot path. Compute the argument text only when an enabled log or the failure message needs it, using a local nullable cache instead of an unconditional Lazy.

        var argumentsText = new Lazy<string>(() => string.Join(' ', arguments));

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:242

• The PR summary says the S6096 fix adds an inline GetFullPath/StartsWith re-verification, but this path still relies on the custom SafePathCombine result before passing destinationPath to ExtractToFile; the only new GetFullPath is used to derive the relative managed-folder check. Add the promised local root-containment guard (or update the description) so the stated analyzer remediation is actually present.

        // PathHelpers.SafePathCombine is the single source of truth for containment validation
        // (see its own doc remarks); it throws ArgumentException/NotSupportedException both when
        // the entry's path would resolve outside repoRoot and for other malformed-path failures,
        // so the original message is preserved here rather than assuming every failure is a
        // traversal attempt.

• Files reviewed: 21/21 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Critical and moderate ZIP extraction findings remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

src/DemaConsulting.AgentControl/AgentToolLauncher/AgentToolLauncher.cs:146

• This Lazy<string> allocates a Lazy object and closure on every launch, even when the supplied logger has all levels disabled. When the normal Serilog configuration is used, Debug is enabled, so the join still runs and this adds allocations compared with the previous one-time string.Join; use a nullable local and compute the string inside the first enabled-log/failure branch instead.

        var argumentsText = new Lazy<string>(() => string.Join(' ', startInfo.ArgumentList));

src/DemaConsulting.AgentControl/GitIntegration/GitClient.cs:367

• This Lazy<string> allocates a Lazy object and closure on every RunGit call, even when all logging is disabled. In the normal application configuration, LoggingSetup sets the minimum level to Debug, so the join still runs and this adds allocations compared with the previous one-time string.Join; use a nullable local and compute the string inside the first enabled-log/failure branch instead of allocating Lazy per invocation.

        var argumentsText = new Lazy<string>(() => string.Join(' ', arguments));

src/DemaConsulting.AgentControl/RepoSync/PackageZipExtractor.cs:69

• The class-level remarks above still describe Extract as open → delete → extract, while this updated method now inserts a pre-delete destination-validation phase. That stale sequence contradicts the safety invariant introduced here and can mislead maintainers about when existing managed content is touched; update the class remarks to document validation before deletion.

    ///     Opens/validates the package zip, validates every entry's destination path, deletes the
    ///     four managed folders under <paramref name="repoRoot"/> if present, and extracts the
    ///     same four folders from the zip into the repo.

• Files reviewed: 23/23 changed files
• Comments generated: 3
• Review effort level: Lite