chore: adopt Central Package Management and collect coverage

[StuartMeeks]

What changed

STANDARD.md §1.2, §1.3, §2.6 — the last three machine-checkable clauses SelfUpdate was failing.

• Directory.Packages.props added; versions leave all three project files. CentralPackageVersionOverrideEnabled=false.
• Thirteen properties restated in every csproj move to Directory.Build.props.
• Microsoft.Testing.Extensions.CodeCoverage added and invoked by CI, with a per-platform artifact upload.

Why

CentralPackageVersionOverrideEnabled=false is the half that matters: without it MSBuild silently ignores a stray inline Version= and uses the central one, which is exactly the drift the file exists to prevent.

Coverage: §2.6 exists because a referenced-but-never-invoked collector is worse than none — it reads as coverage in the dependency list while producing no data. So this adds the package and dotnet test … -- --coverage. Verified locally: one .coverage file per target framework.

The demo project opts GenerateDocumentationFile back off. It is not shipped, so its types are not public surface, and demanding XML docs on sample code would fail the build under TreatWarningsAsErrors — the same reasoning §2.7 applies to the test project.

No dependency floor was raised. Per-TFM floors survive intact — CPM re-evaluates the conditional ItemGroups per target framework during the inner build, so net8.0 still floors at 8.0.2 / 8.0.1 and net10.0 at 10.0.11. Raising a floor is consumer-visible and belongs in its own reviewed commit.

Proof that the package is unchanged

Packed before and after from clean obj/ at the same commit, then extracted and compared file by file:

File	Result
.nuspec (nupkg and snupkg)	byte-identical
lib/net8.0/*.dll, lib/net10.0/*.dll	byte-identical
lib/net8.0/*.xml, lib/net10.0/*.xml	byte-identical
lib/net8.0/*.pdb, lib/net10.0/*.pdb	byte-identical
README.md, icon.png, [Content_Types].xml	byte-identical
*.psmdcp	filename differs, content identical
_rels/.rels	differs only in the Target=/Id naming that psmdcp

That is exactly the bar ADOPTING.md sets — the .psmdcp filename is regenerated by NuGet on every pack.

A false positive worth recording

A first attempt appeared to show both assemblies differing. It did not. The "before" pack had reused a stale obj/, so the two builds embedded different git commit SHAs via SourceLink, which moved the MVID and the deterministic PE stamp with them. Decoding the differing byte runs showed the two SHAs as ASCII directly (1acc08c3… vs 9caf8240…). Rebuilding both from clean obj/ removed the difference entirely.

Recording it because that failure mode looks precisely like a real packaging regression, and 46 differing byte-runs in a shipped assembly is not something to wave through.

Checklist

• Build is clean — no new warnings (TreatWarningsAsErrors is on)
• Tests pass on every shipped target framework — 392 tests, 196 × net8.0/net10.0, coverage collected on both
• Public API changes carry XML docs — n/a, no code change
• CHANGELOG.md updated under [Unreleased]
• Dependency floors unchanged — proven above

Consumer impact

None, demonstrated rather than asserted. <Version> is untouched and no tag is pushed.

🤖 Generated with Claude Code