C1 drift: re-sync unprotected template-tracked files

.gitattributes

@@ -9,15 +9,19 @@
 *.fsx text eol=lf
 
 # Scripts
-# PowerShell scripts: LF line endings in the index. Required for the
-# `#!/usr/bin/env pwsh` shebang (where present) to work on Linux/macOS
-# — the kernel parses CR as part of the interpreter name (looking for
-# `pwsh\r`). BOM avoidance is enforced separately via `.editorconfig`
-# (`charset = utf-8` in the global `[*]` section); git attributes can
-# only normalize line endings, not byte-order marks. The top-of-file
-# `* text=auto eol=lf` rule also means Windows users get LF in their
-# working tree regardless of `core.autocrlf` — intentional so the
-# shebang works there too.
+# PowerShell scripts: enforce LF line endings in both the index AND
+# the working tree (the explicit `eol=lf` overrides any user-level
+# `core.autocrlf=true` setting that would otherwise convert to CRLF
+# on checkout). BOM-free UTF-8 encoding is enforced separately by
+# .editorconfig's global `charset = utf-8` — `.gitattributes` can
+# normalize line endings (and control text/binary, diff, and merge
+# behavior) but has no attribute for byte-order marks.
+#
+# LF is required for the `#!/usr/bin/env pwsh` shebang to work on
+# Linux/macOS — the kernel parses CR as part of the interpreter name
+# (looking for `pwsh\r`), and a UTF-8 BOM before `#!` would prevent
+# shebang recognition entirely. Modern PowerShell 7+ handles LF on
+# Windows transparently.
 *.ps1 text eol=lf
 
 

.github/ISSUE_TEMPLATE/maintenance-task.yaml

@@ -0,0 +1,76 @@
+name: "✨ Maintenance task"
+description: "Track an actionable improvement under the Maintenance framework (security, performance, testing, cleanup, docs, API, or CI/CD)."
+title: "[Maintenance] <category>: <short description>"
+labels: [maintenance-task]
+assignees: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Maintenance framework sub-issue
+
+        This template creates a **`maintenance-task`** sub-issue under this repo's parent `Maintenance: <repo>` issue. The new issue will auto-appear in the cross-repo Maintenance project board (URL listed in the parent `Maintenance: <repo>` issue body).
+
+        - Pick exactly **one** category in the dropdown below. The corresponding `maintenance - <category>` label will need to be added manually after creation (issue forms don't yet support dynamic label addition).
+        - Fill in **Scope** (what's done & why), **Acceptance** (when do we close this?), and **Links** (PRs, scan output, related issues).
+        - If you're closing this issue via a PR, include `Fixes #<this-issue-number>` in the PR body so the auto-add workflow marks the project item as Done.
+
+  - type: dropdown
+    id: category
+    attributes:
+      label: Category
+      description: "Pick exactly one. After creation, also add the corresponding `maintenance - <category>` label."
+      options:
+        - "security — scans, finding fixes, dependency vulnerability audit"
+        - "performance — profile, benchmark, optimize, validate gains"
+        - "testing — coverage, integration/smoke/mutation tests, fixtures"
+        - "cleanup — refactor for reuse / quality / efficiency"
+        - "docs — XML doc coverage, README, CHANGELOG, samples"
+        - "API — public/internal surface audit, breaking-change vigilance"
+        - "CI/CD — Docker, CI workflow, build/publish pipeline"
+    validations:
+      required: true
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope
+      description: "What needs to be done? What's the motivation?"
+      placeholder: |
+        e.g.
+        - Profile the hot path in `Extractor.ExtractAsync` and identify the dominant allocations.
+        - Goal: reduce per-record allocations to enable streaming larger inputs.
+    validations:
+      required: true
+
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: "When do we close this issue? Concrete observable outcomes."
+      placeholder: |
+        e.g.
+        - Benchmark X shows <50% of current allocations.
+        - No regression in existing benchmark suite (>5%).
+        - Updated benchmark numbers committed.
+    validations:
+      required: true
+
+  - type: textarea
+    id: links
+    attributes:
+      label: Links
+      description: "Related PRs, scan output, prior issues, external references."
+      placeholder: |
+        - Related PR: #...
+        - Scan output: ...
+        - Related issue: #...
+    validations:
+      required: false
+
+  - type: markdown
+    attributes:
+      value: |
+        ---
+
+        💡 **Tip for agents (Copilot etc.):** When opening a maintenance-task sub-issue, use this template and pick the matching category. After creation, add the `maintenance - <category>` label manually. See `.github/copilot-instructions.md` for the full Maintenance framework convention.

.github/dependabot.yml

@@ -7,8 +7,20 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
-      - "dotnet"
     groups:
       dotnet-dependencies:
         patterns:
           - "*"
+
+  # Keep third-party GitHub Actions pinned in workflows up to date.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/pull_request_template.md

@@ -4,6 +4,18 @@
 
 Fixes/Complete # (issue)
 
+<!--
+If this PR addresses a Maintenance framework sub-issue, link it explicitly so the
+project board auto-marks the item as Done on merge:
+
+  Fixes #<maintenance-task-issue-number>
+
+The Maintenance framework tracks ongoing improvement work (security, performance,
+testing, cleanup, docs, API, CI/CD) — see the parent `Maintenance: <repo>` issue
+for details.
+-->
+
+
 ## Type of change
 
 Please delete options that are not relevant.

CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+### Changed
+
+### Deprecated
+
+### Removed
+
+### Fixed
+
+### Security

CONTRIBUTING.md

@@ -62,9 +62,11 @@ All code is analyzed by these tools during build:
    - Advanced C# pattern detection
 
 3. **AsyncFixer**
-   - Detects async/await anti-patterns
-   - Ensures proper `ConfigureAwait()` usage
-   - Prevents fire-and-forget async calls
+   - Detects common async/await anti-patterns (AsyncFixer01–05)
+   - Flags missing or incorrect cancellation-token propagation
+   - Prevents fire-and-forget async calls (`async void` outside event handlers)
+   - NOTE: `ConfigureAwait()` enforcement is handled by Meziantou's
+     MA0004 / SonarAnalyzer S3216 / CA2007, not by AsyncFixer.
 
 4. **Microsoft.VisualStudio.Threading.Analyzers**
    - Thread safety enforcement
@@ -145,7 +147,7 @@ var now = DateTimeOffset.UtcNow;
 ## Build and Test Instructions
 
 ### Prerequisites
-- .NET 8.0 SDK or later
+- .NET 10.0 SDK or later (required for the repo's net10.0 target; older SDKs cannot load the csproj)
 - PowerShell Core (optional, for formatting scripts)
 
 ### Build the Project
@@ -182,10 +184,10 @@ dotnet format
 dotnet format --verify-no-changes
 
 # PowerShell formatting script
-pwsh ./format.ps1
+pwsh ./scripts/format.ps1
 ```
 
-See [README-FORMATTING.md](README-FORMATTING.md) for detailed formatting rules.
+See [docs/README-FORMATTING.md](docs/README-FORMATTING.md) for detailed formatting rules.
 
 ---
 
@@ -237,4 +239,3 @@ Please be respectful and considerate in all interactions. See [CODE_OF_CONDUCT.m
 ---
 
 Thank you for contributing! 🎉
-