Promote develop to main: align refactored tree

.dockerignore

@@ -1,27 +1,37 @@
-**/.mount
-**/.classpath
-**/.dockerignore
-**/.env
-**/.git
-**/.gitignore
-**/.project
-**/.settings
-**/.toolstarget
-**/.vs
-**/.vscode
-**/*.*proj.user
-**/*.dbmdl
-**/*.jfm
-**/azds.yaml
-**/bin
-**/charts
-**/docker-compose*
-**/Dockerfile*
-**/node_modules
-**/npm-debug.log
-**/obj
-**/secrets.dev.yaml
-**/values.dev.yaml
-LICENSE
-README.md
-auth.conf
+# .NET build artifacts
+**/bin/
+**/obj/
+**/out/
+.artifacts/
+**/.artifacts/
+
+# Visual Studio / VS Code
+.vs/
+.vscode/
+*.user
+*.suo
+*.userosscache
+*.sln.docstates
+
+# Test results
+TestResults/
+**/TestResults/
+
+# NuGet packages
+*.nupkg
+*.snupkg
+packages/
+
+# Git
+.git/
+.gitignore
+.gitattributes
+
+# CI/CD
+.github/
+.codex
+
+# Other
+*.log
+*.tmp
+*.cache

.editorconfig

@@ -8,7 +8,7 @@
 # https://github.com/dotnet/runtime/blob/main/.editorconfig
 
 # https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-format
-# dotnet format style --verify-no-changes --severity=info --verbosity=detailed --exclude-diagnostics=IDE0055
+# dotnet format style --verify-no-changes --severity=info --verbosity=detailed
 
 # Root config
 root = true
@@ -22,7 +22,7 @@ insert_final_newline = true
 trim_trailing_whitespace = true
 
 # Markdown files
-[*.{md}]
+[*.md]
 end_of_line = crlf
 trim_trailing_whitespace = false
 
@@ -39,7 +39,6 @@ indent_size = 2
 # Json files
 [*.json]
 end_of_line = crlf
-indent_size = 4
 
 # Linux scripts
 [*.sh]
@@ -54,6 +53,29 @@ end_of_line = crlf
 end_of_line = crlf
 dotnet_diagnostic.IDE0055.severity = none
 dotnet_analyzer_diagnostic.severity = suggestion
+
+# Public API surface rules: not applicable, this is a console app not a reusable library
+dotnet_diagnostic.CA1002.severity = none  # Do not expose List<T>
+dotnet_diagnostic.CA1024.severity = none  # Use properties where appropriate
+dotnet_diagnostic.CA1034.severity = none  # Nested types should not be visible
+dotnet_diagnostic.CA1052.severity = none  # Static holder types (builder pattern uses partial classes)
+dotnet_diagnostic.CA1055.severity = none  # URI return values should not be strings
+dotnet_diagnostic.CA1056.severity = none  # URI properties should not be strings
+dotnet_diagnostic.CA1062.severity = none  # Validate parameters of public methods
+dotnet_diagnostic.CA1515.severity = none  # Consider making public types internal
+dotnet_diagnostic.CA1724.severity = none  # Type names should not match namespaces
+dotnet_diagnostic.CA2227.severity = none  # Collection properties should be read only
+
+# Console app context: no localization, no SynchronizationContext, intentional case usage
+dotnet_diagnostic.CA1303.severity = none  # Do not pass literals as localized parameters
+dotnet_diagnostic.CA1307.severity = none  # Specify StringComparison for clarity
+dotnet_diagnostic.CA1308.severity = none  # Normalize strings to uppercase (code intentionally lowercases)
+dotnet_diagnostic.CA2007.severity = none  # ConfigureAwait (console app has no SynchronizationContext)
+dotnet_diagnostic.CA2234.severity = none  # Pass System.Uri instead of string
+
+# False positives or inapplicable in this codebase
+dotnet_diagnostic.CA1508.severity = none  # Dead code (false positive with ??= pattern)
+dotnet_diagnostic.CA5392.severity = none  # DefaultDllImportSearchPaths (limited intentional P/Invoke, risk accepted)
 csharp_indent_block_contents = true
 csharp_indent_braces = false
 csharp_indent_case_contents = true
@@ -73,7 +95,7 @@ csharp_prefer_simple_using_statement = true
 csharp_prefer_static_anonymous_function = true
 csharp_prefer_static_local_function = true
 csharp_prefer_system_threading_lock = true
-csharp_preferred_modifier_order = public,private,protected,internal,file,static,extern,new,virtual,abstract,sealed,override,readonly,unsafe,required,volatile,async
+csharp_preferred_modifier_order = public,private,protected,internal,file,static,abstract,sealed,virtual,override,readonly,unsafe,volatile,async,extern,new,partial:warning
 csharp_preserve_single_line_blocks = true
 csharp_preserve_single_line_statements = false
 csharp_space_after_cast = false
@@ -204,3 +226,9 @@ dotnet_style_qualification_for_method = false
 dotnet_style_qualification_for_property = false
 dotnet_style_readonly_field = true
 dotnet_style_require_accessibility_modifiers = for_non_interface_members
+
+# ReSharper settings
+resharper_csharp_trailing_comma_in_multiline_lists = true
+resharper_csharp_var_for_built_in_types = false
+resharper_csharp_var_when_type_is_apparent = false
+resharper_csharp_var_when_type_is_not_apparent = false

.github/copilot-instructions.md

@@ -13,6 +13,18 @@ PlexCleaner is a .NET 10.0 CLI utility that optimizes media files for Direct Pla
 
 The tool orchestrates external media processing tools (FFmpeg, HandBrake, MkvToolNix, MediaInfo, 7-Zip) via CLI wrappers.
 
+## Branching, Releases, and Bot Behavior
+
+For full rationale see [`AGENTS.md`](../AGENTS.md). Quick rules:
+
+- `feature → develop → main`. PRs only.
+- Develop accepts **squash merges only**; main accepts **merge commits only**. Don't suggest rebase-merge — it's disabled at the repo level.
+- Both branches **auto-publish on push**: develop produces NBGV prereleases (`X.Y.Z-g{sha}`) tagged `develop` on Docker Hub; main produces stable releases (`X.Y.Z`) tagged `latest`.
+- Dependabot targets **both** `main` and `develop` with the same ecosystems; major NuGet bumps gate on human review, everything else auto-merges via App-token-driven merge-bot.
+- Every third-party GitHub Action is pinned to a full commit SHA with a `# vX.Y.Z` comment. Don't introduce `@v6` / `@main` / `@master` floating refs.
+- Don't recommend `git push --force` or `--force-with-lease`; both rulesets enforce `non_fast_forward`.
+- `version.json`'s `publicReleaseRefSpec` is `^refs/heads/main$` — bumping the base `version` field is the only manual versioning action.
+
 ## Documentation
 
 User-facing documentation is organized as follows:
@@ -215,6 +227,13 @@ Parser design patterns:
 - Logging: Serilog with thread IDs (`Log.Information/Warning/Error`)
 - Exception handling: Currently uses broad `catch(Exception)` - TODO to specialize
 - Global usings: `GlobalUsing.cs` defines project-wide type aliases (`ConfigFileJsonSchema`, `SidecarFileJsonSchema`)
+- `Directory.Build.props`: Common MSBuild properties (`TargetFramework`, `Nullable`, `ImplicitUsings`,
+  `AnalysisLevel`, etc.) shared across all projects live here at the solution root. Do not duplicate
+  these in individual `.csproj` files -- only add a property to a `.csproj` when it is project-specific
+  or overrides the shared default.
+- `Directory.Packages.props`: All NuGet package versions are centralised here via `PackageVersion` items.
+  `PackageReference` elements in `.csproj` files must not include a `Version` attribute. Asset metadata
+  (`PrivateAssets`, `IncludeAssets`) stays in the `.csproj` `PackageReference` element.
 
 ### Naming and Structure
 
@@ -281,15 +300,15 @@ dotnet husky run
 
 ### GitHub Actions
 
-- **BuildGitHubRelease.yml**: Multi-runtime matrix build (win, linux, osx × x64/arm/arm64)
-- **BuildDockerPush.yml**: Multi-arch Docker builds (linux/amd64, linux/arm64)
-- **TestBuildPr.yml** / **TestDockerPr.yml**: PR validation
+- **publish-release.yml**: Multi-runtime matrix build (win, linux, osx x x64/arm/arm64)
+- **publish-periodic-docker-release.yml**: Multi-arch Docker builds (linux/amd64, linux/arm64)
+- **test-pull-request.yml**: PR validation
 - Version info: `version.json` with Nerdbank.GitVersioning format
 - Branches: `main` (stable releases), `develop` (pre-releases)
 
 ### Docker
 
-- Multi-stage builds in `Docker/Ubuntu.Rolling.Dockerfile`
+- Multi-stage builds in `Docker/Dockerfile`
 - Base image: `ubuntu:rolling` only (no longer publishing Alpine or Debian variants)
 - Supported architectures: `linux/amd64`, `linux/arm64` (no longer supporting `linux/arm/v7`)
 - Tool installation: Ubuntu package manager (apt)
@@ -440,3 +459,12 @@ Check states with `HasFlag()`, combine with `|=`
 - **KeepAwake.cs**: System sleep prevention
 - **PlexCleaner.defaults.json**: Canonical configuration reference
 - **.editorconfig** / **.csharpier.json**: Code style definitions
+
+## Git and Commit Rules
+
+**These rules are absolute — no exceptions:**
+
+- **Never make git commits.** All commits must be cryptographically signed (SSH/GPG). AI coding agents cannot produce signed commits. Stage changes with `git add` and leave `git commit` to the developer, who must run it in their own environment where signing keys are available.
+- **Never force push.** Do not run `git push --force` or `git push --force-with-lease`. Force pushing rewrites shared branch history and is blocked by branch protection rules.
+- **Never run destructive git commands** (`git reset --hard`, `git checkout .`, `git restore .`, `git clean -f`) without explicit developer instruction.
+- **Staging is the limit.** Prepare changes and stage files; the developer handles all commits and pushes.

.github/dependabot.yml

@@ -1,43 +1,43 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-version: 2
-updates:
-
-  # main
-- package-ecosystem: "nuget"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    nuget-deps:
-      patterns:
-        - "*"
-- package-ecosystem: "github-actions"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    actions-deps:
-      patterns:
-        - "*"
-
-  # develop
-- package-ecosystem: "nuget"
-  target-branch: "develop"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    nuget-deps:
-      patterns:
-        - "*"
-- package-ecosystem: "github-actions"
-  target-branch: "develop"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    actions-deps:
-      patterns:
-        - "*"
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+
+  # main
+  - package-ecosystem: "nuget"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+  - package-ecosystem: "github-actions"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
+
+  # develop
+  - package-ecosystem: "nuget"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+  - package-ecosystem: "github-actions"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"