Harden dependency and release supply chains (#11)

- lock NuGet dependency graphs
  - add deterministic hostile-input property tests
  - stage and attest exact packages before OIDC publication
  - make GitHub and NuGet release recovery fail-safe

Author: jecacs

.github/workflows/ci.yml

@@ -21,6 +21,7 @@ jobs:
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 8.0.x
+          dotnet-quality: ga
 
       # setup-dotnet proves installation, while global.json controls selection. Assert the actual
       # resolver result because hosted runners also have newer SDK majors preinstalled.
@@ -35,7 +36,7 @@ jobs:
           fi
 
       - name: Restore
-        run: dotnet restore -p:NuGetAuditMode=all -warnaserror
+        run: dotnet restore --locked-mode -p:NuGetAuditMode=all -warnaserror
 
       # Hard gate: the project keeps a zero-warning build, so fail CI on any warning.
       - name: Build
@@ -147,6 +148,7 @@ jobs:
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 8.0.x
+          dotnet-quality: ga
 
       - name: Verify .NET 8 SDK selection
         shell: bash
@@ -159,7 +161,7 @@ jobs:
           fi
 
       - name: Restore and audit dependencies
-        run: dotnet restore -p:NuGetAuditMode=all -warnaserror
+        run: dotnet restore --locked-mode -p:NuGetAuditMode=all -warnaserror
 
       - name: Pack and validate public API
         run: dotnet pack src/SolSharp/SolSharp.csproj -c Release -o artifacts -p:Version=999.0.0-ci --no-restore -warnaserror

.github/workflows/codeql.yml

@@ -11,12 +11,14 @@ on:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   analyze:
     name: analyze-csharp
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -32,9 +34,20 @@ jobs:
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 8.0.x
+          dotnet-quality: ga
+
+      - name: Verify .NET 8 SDK selection
+        shell: bash
+        run: |
+          selected_version="$(dotnet --version)"
+          if [[ "${selected_version}" != 8.* ]]; then
+            echo "Expected a .NET 8 SDK, but dotnet selected ${selected_version}."
+            dotnet --info
+            exit 1
+          fi
 
       - name: Restore
-        run: dotnet restore -p:NuGetAuditMode=all -warnaserror
+        run: dotnet restore --locked-mode -p:NuGetAuditMode=all -warnaserror
 
       - name: Build for CodeQL
         run: dotnet build --no-restore --configuration Release -warnaserror