feat(audit): Apply TreatWarningsAsErrors=true to 160+ production csproj files

Sprint: SPRINT_20251229_049_BE_csproj_audit_maint_tests
Tasks: AUDIT-0001 through AUDIT-0147 APPLY tasks (approved decisions 1-9)

Changes:
- Set TreatWarningsAsErrors=true for all production .NET projects
- Fixed nullable warnings in Scanner.EntryTrace, Scanner.Evidence,
  Scheduler.Worker, Concelier connectors, and other modules
- Injected TimeProvider/IGuidProvider for deterministic time/ID generation
- Added path traversal validation in AirGap.Bundle
- Fixed NULL handling in various cursor classes
- Third-party GostCryptography retains TreatWarningsAsErrors=false (preserves original)
- Test projects excluded per user decision (rejected decision 10)

Note: All 17 ACSC connector tests pass after snapshot fixture sync

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Kev/Internal/KevCursor.cs

@@ -17,8 +17,8 @@ internal sealed record KevCursor(
     {
         var document = new DocumentObject
         {
-            ["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(static id => id.ToString())),
-            ["pendingMappings"] = new DocumentArray(PendingMappings.Select(static id => id.ToString())),
+            ["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(static id => id.ToString())),
+            ["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(static id => id.ToString())),
         };
 
         if (!string.IsNullOrEmpty(CatalogVersion))

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Kev/KevConnector.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Text;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using System.Threading;
@@ -18,6 +19,7 @@ using StellaOps.Concelier.Storage;
 using StellaOps.Concelier.Storage.Advisories;
 using StellaOps.Concelier.Storage;
 using StellaOps.Concelier.Storage;
+using StellaOps.Cryptography;
 using StellaOps.Plugin;
 
 namespace StellaOps.Concelier.Connector.Kev;
@@ -40,6 +42,7 @@ public sealed class KevConnector : IFeedConnector
     private readonly ISourceStateRepository _stateRepository;
     private readonly KevOptions _options;
     private readonly IJsonSchemaValidator _schemaValidator;
+    private readonly ICryptoHash _hash;
     private readonly TimeProvider _timeProvider;
     private readonly ILogger<KevConnector> _logger;
     private readonly KevDiagnostics _diagnostics;
@@ -53,6 +56,7 @@ public sealed class KevConnector : IFeedConnector
         ISourceStateRepository stateRepository,
         IOptions<KevOptions> options,
         IJsonSchemaValidator schemaValidator,
+        ICryptoHash cryptoHash,
         KevDiagnostics diagnostics,
         TimeProvider? timeProvider,
         ILogger<KevConnector> logger)
@@ -66,6 +70,7 @@ public sealed class KevConnector : IFeedConnector
         _options = options?.Value ?? throw new ArgumentNullException(nameof(options));
         _options.Validate();
         _schemaValidator = schemaValidator ?? throw new ArgumentNullException(nameof(schemaValidator));
+        _hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
         _diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
         _timeProvider = timeProvider ?? TimeProvider.System;
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
@@ -273,7 +278,7 @@ public sealed class KevConnector : IFeedConnector
                 _diagnostics.CatalogParsed(catalog.CatalogVersion, entryCount);
 
                 var dtoRecord = new DtoRecord(
-                    Guid.NewGuid(),
+                    ComputeDeterministicId(document.Id.ToString(), "kev/1.0"),
                     document.Id,
                     SourceName,
                     SchemaVersion,
@@ -438,4 +443,11 @@ public sealed class KevConnector : IFeedConnector
 
     private static Uri? TryParseUri(string? value)
         => Uri.TryCreate(value, UriKind.Absolute, out var uri) ? uri : null;
+
+    private Guid ComputeDeterministicId(string source, string identifier)
+    {
+        var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
+        var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
+        return new Guid(hash.AsSpan()[..16]);
+    }
 }

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Kev/StellaOps.Concelier.Connector.Kev.csproj

@@ -5,6 +5,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>