fix: analyze top-level CancellationTokenSource ownership

[georgepwall1991]

Summary

• treat the compilation unit as the synthesized function scope for top-level programs
• diagnose undisposed top-level CancellationTokenSource locals
• pin the existing using var code fix at top level
• preserve nearer nested-function capture boundaries
• prepare v1.27.179 release metadata

Why

CC014 registered top-level local declarations but abandoned them because no method-like ancestor existed. Console, worker, and minimal-host entry points could therefore leak CTS resources silently.

Validation

• red-first analyzer regression reproduced the false negative
• focused CC014 analyzer/code-fix tests: 16 passed
• full suite: 635 passed, 0 failed
• Release build: 0 errors (62 intentional sample analyzer warnings)
• touched-file whitespace verification: clean
• package inspection: both analyzer assemblies present; no NuGet dependencies
• self-review completed as requested; no Claude review used

Tooling note

Slopwatch is required by the local .NET overlay but unavailable on this host (command not found). Manual hygiene and exact-diff review are clean.