feat(analyzers): ship QuerySpec.Analyzers package with QSPEC0001/2/3 diagnostics and code fixes

[AbongileBoja]

Summary

Ships QuerySpec.Analyzers — a standalone Roslyn analyzer + code-fix NuGet package that powers the 3.x → 4.0 migration window for the three deprecated APIs introduced in #84:

Diagnostic	Trigger	Replacement
QSPEC0001	GeoLocation.Latitude / .Longitude member access	GeoCoordinate (call legacy.ToGeoCoordinate().Latitude)
QSPEC0002	new AdvancedFilterExpression { ... }	FilterSpec (immutable record with init accessors)
QSPEC0003	ICacheProvider.GetAsync<T> / SetAsync<T> invocation	ICacheStore.TryGetAsync<T> / SetValueAsync<T>

All three carry one-click code fixes and Fix-All-In-Document/Project/Solution support via WellKnownFixAllProviders.BatchFixer.

Closes #151.

Files added

src/QuerySpec.Analyzers/                  -> ships as analyzers/dotnet/cs/QuerySpec.Analyzers.dll
  QuerySpec.Analyzers.csproj              netstandard2.0, IsPackable=true, IncludeBuildOutput=false
  DiagnosticIds.cs                        QSPEC0001/2/3 string consts
  DiagnosticDescriptors.cs                static readonly DiagnosticDescriptor singletons
  GeoLocationMemberAccessAnalyzer.cs      QSPEC0001 — SimpleMemberAccessExpression registration
  AdvancedFilterExpressionAnalyzer.cs     QSPEC0002 — ObjectCreationExpression registration
  CacheProviderInvocationAnalyzer.cs      QSPEC0003 — InvocationExpression registration
  AnalyzerReleases.{Shipped,Unshipped}.md release-tracking AdditionalFiles
  PublicAPI.{Shipped,Unshipped}.txt       PublicAPI baselines

src/QuerySpec.Analyzers.CodeFixes/        -> ships as analyzers/dotnet/cs/QuerySpec.Analyzers.CodeFixes.dll
  QuerySpec.Analyzers.CodeFixes.csproj    netstandard2.0, IsPackable=false (packed by sibling)
  GeoLocationMemberAccessCodeFixProvider.cs   rewrites legacy.Latitude -> legacy.ToGeoCoordinate().Latitude
  AdvancedFilterExpressionCodeFixProvider.cs  rewrites new AdvancedFilterExpression { ... } -> new FilterSpec { ... }
  CacheProviderInvocationCodeFixProvider.cs   rewrites SetAsync -> SetValueAsync; await GetAsync<T>(k) -> (await TryGetAsync<T>(k)).GetValueOrDefault()

tests/QuerySpec.Analyzers.Tests/          27 tests x 3 TFMs (net8/9/10) = 81 green
  QuerySpec.Analyzers.Tests.csproj
  GeoLocationMemberAccessAnalyzerTests.cs
  AdvancedFilterExpressionAnalyzerTests.cs
  CacheProviderInvocationAnalyzerTests.cs
  Verifiers/CSharpAnalyzerVerifier.cs     wraps CSharpAnalyzerTest with DefaultVerifier
  Verifiers/CSharpCodeFixVerifier.cs      wraps CSharpCodeFixTest with DefaultVerifier
  Verifiers/QuerySpecReferenceAssemblies.cs   pinned to .NET 8 ReferenceAssemblies for stable BCL surface
  Verifiers/TestStubs.cs                  inline-stub the QuerySpec.Core types so tests don't pull
                                          [Obsolete(DiagnosticId)]-emitted compiler warnings into the
                                          analyzer's diagnostic stream — analyzer logic is exercised
                                          in isolation

QuerySpec.sln updated; CHANGELOG [Unreleased] -> Added entry added.

Architecture decisions

1. Standalone NuGet package, not bundled into QuerySpec.Core. Microsoft's canonical pattern (Microsoft.AspNetCore.App.Analyzers, System.Text.Json.SourceGeneration) lets consumers update analyzers independently of runtime. Adding the analyzer DLL inside QuerySpec.Core's nupkg would lock the analyzer cadence to the runtime cadence and leak the analyzer's Microsoft.CodeAnalysis.* dependency edges into the runtime package's metadata.

2. Two-assembly split (QuerySpec.Analyzers + QuerySpec.Analyzers.CodeFixes). RS1038 forbids analyzer assemblies from referencing Microsoft.CodeAnalysis.Workspaces (which only loads in IDE/CLI compile-only scenarios fail otherwise). Code fixes legitimately need Workspaces. Both DLLs ship in the same nupkg under analyzers/dotnet/cs/.

3. netstandard2.0 TFM. This is the documented exception to the repo-wide net8/9/10 policy (Directory.Build.props comment + <TargetFramework> override + this PR's CHANGELOG entry): Roslyn loads analyzers into a netstandard2.0 ALC regardless of the consumer project's target.

4. Self-suppression on [Obsolete(DiagnosticId="QSPEC####")]. The 3.1 source already carries those attributes, so the compiler emits the diagnostic and our analyzer would otherwise duplicate it. Each analyzer walks the candidate symbol's attributes (and, for ICacheProvider, the implemented interface members) and skips emission when a matching DiagnosticId is found. Net result: consumers see exactly one warning per call site, sourced from whichever path is available.

5. Code-fix scope: the QSPEC0003 fix deliberately does NOT auto-rewrite the variable's declared type from ICacheProvider to ICacheStore. That's a cross-file decision the developer should make in context (DI registration, downstream usages). The fix produces well-formed code only when the receiver implements ICacheStore; otherwise the developer gets a compile error guiding them to the next migration step. Test cases cover the well-typed scenario via a dual-interface TestCacheProvider stub matching the shipping MemoryCacheProvider/DistributedCacheProvider/MultiLevelCache shape.

Test plan

• dotnet build -c Release -p:QUERYSPEC_SKIP_SIGN=true — clean (0 errors, 624 pre-existing Meziantou warnings unchanged)
• dotnet test tests/QuerySpec.Analyzers.Tests/QuerySpec.Analyzers.Tests.csproj — 27 tests x 3 TFMs (net8/9/10) = 81 green
• dotnet pack src/QuerySpec.Analyzers/QuerySpec.Analyzers.csproj -c Release -p:QUERYSPEC_SKIP_SIGN=true — produces valid .nupkg
• unzip -l QuerySpec.Analyzers.0.0.0-local.nupkg — confirms analyzers/dotnet/cs/QuerySpec.Analyzers.dll and analyzers/dotnet/cs/QuerySpec.Analyzers.CodeFixes.dll, README, icon present
• dotnet test tests/QuerySpec.Core.Tests/... — 636/636 net8 (no regression, analyzer is consumer-side)
• dotnet test tests/QuerySpec.EFCore.Tests/... — 91/91 net8 (no regression)
• CI green across all gates (build/test/codeql/format/vuln/repro/dependency-review)

Per-test coverage matrix (each analyzer + code-fix pair):

• Positive trigger (read/create/invoke)
• Negative on the replacement type (GeoCoordinate, FilterSpec, ICacheStore)
• Negative on an unrelated same-name symbol
• #pragma warning disable QSPEC#### suppression
• Self-suppression when source already carries [Obsolete(DiagnosticId)]
• HelpLinkUri constant verification
• Single-occurrence code fix
• Multi-occurrence FixAll

[AbongileBoja]

Quality-reviewer gate: PASS. All checklist items verified. Build/test/format/reproducibility/vuln-scan/dep-review/commitlint: pass. CodeQL: pass. See full review summary in PR dispatch chat.