Carry fleet governance baseline from the hub

[ptr727]

Summary

Governance-carry step of the hub convergence (#14); the CODESTYLE.md re-vendor covers the scope of #13. Per the carried release model, closing keywords belong on the develop -> main promotion PR, so none are used here.

• Verbatim carries (byte-identical to the hub canonical): WORKFLOW.md, .markdownlint-cli2.jsonc (replaces the hand-modified local copy), repo-config/develop.json, repo-config/main.json, repo-config/settings.json, repo-config/README.md, repo-config/configure.sh.
• AGENTS.md: all carried sections in hub order. Repository Boundaries and Write Safety, Git and Commit Rules, and Verification Discipline are byte-identical to the hub. The intent sections carry the hub's current text with surgical adaptations: hub-only references removed, repo-specific examples localized, merge-bot/codegen machinery stated at its current (not yet stood up) state, Release Model condensed to the downstream shape that defers workflow mechanics to WORKFLOW.md.
• CODESTYLE.md: hub canonical, whole file. Python section dropped (no Python in this repo), InternalsVisibleTo placeholders set to PhotoCleanerBenchmarks/PhotoCleanerTests, vscode-tasks reference pointed at ./.vscode/tasks.json, orphaned Python-only reference definitions removed.
• AUDIT.md + spec/secrets.json: repo-scoped self-audit adaptations (standard downstream shape): settings diff, normalized ruleset diff against the committed payloads, names-only secrets check. Secrets: baseline App pair (both stores) + CODECOV_TOKEN (Actions). No publish mechanisms until the release pipeline lands.
• version.json: NBGV, hub-style, version floor 1.0.
• .github/dependabot.yml: nuget + github-actions ecosystems, dual-target main + develop, daily, grouped.
• README.md: Update subsections renamed to unique headings - the verbatim markdownlint config no longer carries the local MD024 siblings_only exception the old headings depended on.

Verification

• Verbatim files confirmed byte-identical to the hub with cmp; the three verbatim AGENTS.md sections asserted byte-identical during assembly.
• markdownlint-cli2 (all .md): 0 issues. cspell (README.md + HISTORY.md): 0 issues. editorconfig-checker: exit 0.
• Line endings preserved per convention: CRLF for md/json/yml, LF for configure.sh (+x preserved).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR carries the fleet governance baseline into PhotoCleaner by introducing the standard CI/CD workflow contract docs, repository self-audit guidance, ruleset/settings payloads, and Dependabot configuration, plus small README adjustments to align with the carried markdownlint configuration.

Changes:

• Add fleet-standard governance documents and manifests (AGENTS.md, WORKFLOW.md, CODESTYLE.md, AUDIT.md, spec/secrets.json, version.json).
• Add repo-config payloads and an apply/check script for settings + branch rulesets (repo-config/*).
• Align markdownlint configuration and adjust README headings to avoid duplicate-heading lint violations.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
WORKFLOW.md	Adds the carried workflow contract and test methodology for GitHub Actions.
version.json	Introduces NBGV version floor and default-branch release ref spec.
spec/secrets.json	Adds the repo-scoped secrets manifest for audit/baseline validation.
repo-config/settings.json	Adds the committed baseline for repo settings applied via API.
repo-config/README.md	Documents the repo-config payloads and apply/check usage.
repo-config/main.json	Adds the committed main ruleset payload baseline.
repo-config/develop.json	Adds the committed develop ruleset payload baseline.
repo-config/configure.sh	Adds an apply/check script to enforce and validate settings/rulesets.
README.md	Renames update subsections to avoid duplicate headings under stricter MD024.
CODESTYLE.md	Re-vendors fleet-style conventions and verification workflow documentation.
AUDIT.md	Adds a self-audit procedure for settings/rulesets/secrets drift.
AGENTS.md	Carries fleet agent governance rules and PR review contract into the repo.
.markdownlint-cli2.jsonc	Replaces the local markdownlint config with the carried baseline settings.
.github/dependabot.yml	Adds dual-target Dependabot updates for main and develop.

Comments suppressed due to low confidence (4)

CODESTYLE.md:54

• These task names use .NET ... casing, but the actual VS Code tasks are named .Net Build / .Net Format. This makes the documented clean-compile task chain inaccurate.

1. **The `.NET Format` clean-compile task** (see [Clean-Compile Verification][clean-compile-verification])
- The .NET clean-compile is the **`.NET Format`** VS Code task, which chains `CSharpier Format` -> `.NET Build` -> `dotnet format style --verify-no-changes`. These three task definitions are carried verbatim in [`.vscode/tasks.json`][vscode-tasks].
- After any code change it must pass before commit. Run the `.NET Format` task. To run it natively instead, reproduce that task chain from [`.vscode/tasks.json`][vscode-tasks] exactly - `CSharpier Format`, then `.NET Build`, then the `dotnet format style --verify-no-changes --severity=info ...` verify - without dropping or loosening any argument (tasks.json is the canonical command spec). Bare `dotnet format` alone, skipping CSharpier or the build, is not sufficient.

CODESTYLE.md:58

• This claims .NET projects enforce <AnalysisMode>All</AnalysisMode> and <TreatWarningsAsErrors>true</TreatWarningsAsErrors>, but the repo's .csproj files currently do not set either property. The doc should either reflect current project settings or the projects should be updated to match this policy.

2. **Analyzer configuration**
- `<EnableNETAnalyzers>true</EnableNETAnalyzers>` with `<AnalysisLevel>latest-all</AnalysisLevel>` and `<AnalysisMode>All</AnalysisMode>` (full analyzer set enabled)
- `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` - any diagnostic surfaced as a warning fails the build, so it must be fixed or deliberately suppressed, not left to accumulate (see [Analyzer Diagnostics and Suppressions][analyzer-diagnostics-and-suppressions])

CODESTYLE.md:70

• The task list uses .NET ... labels, but .vscode/tasks.json defines .Net Build and .Net Format. This mismatch makes it harder for contributors (and agents) to run the intended tasks.

- `.NET Build`: Build with diagnostic verbosity *(clean-compile)*
- `CSharpier Format`: Auto-format code with CSharpier *(clean-compile)*
- `.NET Format`: Run CSharpier and build, then verify formatting and style with `--verify-no-changes` *(clean-compile; the task to run after edits)*

CODESTYLE.md:294

• This forbids all native xUnit asserts, but the repo uses Assert.Skip(...) in tests to skip when external tools are unavailable. The rule should carve out Assert.Skip as an allowed exception so the guidance matches the codebase's existing test strategy.

1. **Framework**: **xUnit v3 or later** (the `xunit.v3` package, never the legacy v2 `xunit` package) with **AwesomeAssertions** for every assertion; native xUnit asserts (`Assert.Equal`, `Assert.True`, ...) are not allowed - use the fluent `.Should()` API

[ptr727]

Declined: repo-config/configure.sh is a verbatim carry of the fleet canonical (spec/files.json marks it fidelity: verbatim), so modifying it downstream would be flagged by the fleet audit as locally modified fixed content. The AGENTS.md write-safety rule governs agent-issued ad-hoc mutations, not hub-owned scripts (which run under set -Eeuo pipefail, so a failed API write still aborts loudly via exit code). The suppression concern is being raised at the hub as part of the current feedback round; if the canonical changes, the next carry picks it up.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.96%. Comparing base (2129f49) to head (d372ef0).

Additional details and impacted files

@@ Coverage Diff @@## develop #16 +/- ##
========================================
Coverage 44.96% 44.96% ========================================
Files 25 25 Lines 3398 3398 Branches 259 259 ========================================
Hits 1528 1528 Misses 1824 1824 Partials 46 46 

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.