chore: clear the CodeQL backlog and add codeql.yml query-filters (Standards §4.4, §3.0.1)

[StuartMeeks]

Replaces #30, which GitHub auto-closed when its base branch (chore/standards-style-baseline, #29) was deleted on merge. Same commit, rebased onto main.

Prepares the repo for §4.12, which requires a code_scanning merge-protection rule at alerts_threshold: all. Every open alert blocks merge under that rule, so the 177-alert backlog has to be resolved or dismissed before the setting can go on.

§3.0.1 / §4.4 — query-filters

codeql.yml gains the canonical query-filters block excluding cs/unmanaged-code and cs/call-to-unmanaged-code. This package contains no P/Invoke, so the block matches nothing here — it is carried because §3.0.1 requires the workflow to equal the template in non-comment content, and a repo that omits it has forked the template rather than customised it. Closes the 3.0.1 workflow content audit row.

Alerts fixed

Rule	Count	Fix
cs/path-combine	134	Path.Combine → Path.Join, src + tests
cs/catch-of-all-exceptions	19	see below — for dismissal, not fixes
cs/local-not-disposed	13	10 fixed with using; 3 deliberately not (see below)
cs/linq/missed-where	5	Where/Any predicates
cs/linq/missed-select	2	Select
cs/useless-assignment-to-local	1	dropped the unread binding

Path.Join — Path.Combine returns its last rooted argument and silently discards everything before it. Nothing here was reachable with a rooted segment: ValidateAssetName rejects rooted and separator-bearing asset names before any path is built. So this is defence in depth on the install-directory path construction, not a fix for a live defect.

Three alerts deliberately not fixed

Three cs/local-not-disposed sites create a TestConsole that escapes its harness method via the return value; the calling test reads console.Output after that method returns. Applying using at the creation site closes the writer before the command under test writes to it — I tried it, and it failed 46 tests with ObjectDisposedException. Those three now carry a comment explaining why they are not using, and are for dismissal as false positives.

The 19 generic catches

All are deliberate boundary or best-effort catches, and several are contractual: IUpdateSource's XML docs require implementations to swallow transient failures and return null rather than throw, and CleanupOldInstall documents that failures are swallowed and retried next startup. Narrowing them would convert documented never-throw contracts into throwing paths. These are for dismissal with justification — the same treatment Auth gave its boundary catches — not code changes.

Verification

Release build: 0 warnings, 0 errors. dotnet test --configuration Release: 392 passed, 0 failed (196 × net8.0/net10.0).

No change to the public surface or package contents.

🤖 Generated with Claude Code