fix: add missing lastParameter variable in TimeoutCancellationTokenAnalyzer

[thomhurst]

Summary

• PR fix: point analyzer diagnostics to specific parameters instead of methods #4924 introduced a reference to lastParameter on line 73 of TimeoutCancellationTokenAnalyzer.cs without declaring the variable, causing CS0103 build errors on main
• This breaks all PR CI checks (locale tests de-DE, fr-FR, pl-PL fail because the build fails)
• Adds var lastParameter = parameters[parameters.Length - 1] declaration before the usage
• Also points the CancellationTokenMustBeLastParameter diagnostic at the actual CancellationToken parameter location instead of the method

Test plan

• dotnet build TUnit.Analyzers/TUnit.Analyzers.csproj passes with 0 errors
• CI locale tests (de-DE, fr-FR, pl-PL) should pass after merge

[claude]

Code Review

No high-signal issues found. Checked for bugs and CLAUDE.md compliance.

Summary

This is a correct and minimal fix for the regression introduced in #4924. The two changes are both good:

1. var lastParameter = parameters[parameters.Length - 1]; — Properly declares the missing variable that was causing the CS0103 compiler error. The array access is safe because the parameters.IsDefaultOrEmpty guard earlier in the method guarantees at least one element by this point.

2. Improved diagnostic location — Changing the CancellationTokenMustBeLastParameter diagnostic to point at parameters[cancellationTokenIndex] instead of context.Symbol.Locations is a meaningful improvement: it highlights the misplaced CancellationToken parameter directly in the IDE rather than the method declaration site, giving developers a more actionable error squiggle.

Minor Note (non-blocking)

CLAUDE.md asks to "prefer latest syntax and APIs." Since ImmutableArray<T> supports C# 8's index-from-end operator and the project targets LangVersion=latest, the new line could use parameters[^1] instead of parameters[parameters.Length - 1]. That said, the existing codebase uses both patterns in the analyzer project, so this is not a blocker — just something to consider for future consistency.

Overall this is a well-scoped, correct fix.