deps: bump JsonSchema.Net 7→9 and ReverseMarkdown 5→6 (with the source fixes)

[amis92]

Supersedes #15. Dependabot moved the two version pins and nothing else — that branch does not compile. This does the same bump and the migration work.

Stacked on #17 (CI). Base will retarget to main once #17 lands, so CI actually gates this.

JsonSchema.Net 7.3.4 → 9.2.2

Three breaking changes, two of which the compiler catches:

• Evaluate() takes a JsonElement, not a JsonNode.
• EvaluationResults.HasErrors is gone — check Errors directly.
• The one that doesn't fail the build: FromText() now registers each schema by $id into a process-wide registry that refuses to re-register an $id. A second LoadFrom() in the same process throws "Overwriting registered schemas is not permitted". The publisher calls it once so it would have shipped fine — and then exploded the first time anything constructed two validators. Now each validator builds into a registry it owns.

ReverseMarkdown 5.4.0 → 6.1.0

v6 reorganizes Config into grouped options (Tags / Formatting / Links); the flat properties still work but are [Obsolete], so with -warnaserror they must be migrated. Done.

The trap: GithubFlavored looks like it should become Flavor = MarkdownFlavor.GitHub. It must not. They're independent in v6 (set one, the other reads back unchanged), and Flavor = GitHub selects the new round-trip-faithful writer that deliberately preserves raw HTML — it emits <strong>x</strong> instead of **x**, i.e. it stops converting. I made this mistake first; 6 tests caught it. There's now a comment on the config so nobody "cleans it up" later.

Tests

SchemaValidatorTests is new. The publish fixture only ever fed the validator documents that pass, so the rejection path — exactly the code the JsonSchema.Net 9 migration rewrote — had zero coverage. The new tests assert a violation actually names its instance location (/files/0/sha256), not just that it throws.

Verification

• dotnet build -c Release -warnaserror → 0 warnings, 0 errors
• dotnet test -c Release → 826/826 pass (822 existing + 4 new)
• Publisher run end-to-end against the real data/: 12,799 products, 7,349 paints, 76 files all schema-validated, exit 0.

One behavioral change to expect downstream. I diffed v5 vs v6 markdown output through the full HtmlCleaner pipeline on realistic product HTML. Everything normalizes away except one line — v5 leaked & into link URLs:

-Visit [our store](https://games-workshop.com/product?id=1&ref=x) for more.
+Visit [our store](https://games-workshop.com/product?id=1&ref=x) for more.

v5 was emitting broken hrefs; v6 fixes it. So a future product scrape may show & → & diffs in descriptions whose links carry query params. That's a correction, not a regression — flagging it so it isn't mistaken for churn.

Once this lands, #15 can be closed.

🤖 Generated with Claude Code