feat(audit): Apply TreatWarningsAsErrors=true to 160+ production csproj files

Sprint: SPRINT_20251229_049_BE_csproj_audit_maint_tests
Tasks: AUDIT-0001 through AUDIT-0147 APPLY tasks (approved decisions 1-9)

Changes:
- Set TreatWarningsAsErrors=true for all production .NET projects
- Fixed nullable warnings in Scanner.EntryTrace, Scanner.Evidence,
  Scheduler.Worker, Concelier connectors, and other modules
- Injected TimeProvider/IGuidProvider for deterministic time/ID generation
- Added path traversal validation in AirGap.Bundle
- Fixed NULL handling in various cursor classes
- Third-party GostCryptography retains TreatWarningsAsErrors=false (preserves original)
- Test projects excluded per user decision (rejected decision 10)

Note: All 17 ACSC connector tests pass after snapshot fixture sync

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Adobe/AdobeConnector.cs

@@ -21,6 +21,7 @@ using StellaOps.Concelier.Storage;
 using StellaOps.Concelier.Storage;
 using StellaOps.Concelier.Storage.PsirtFlags;
 using StellaOps.Concelier.Models;
+using StellaOps.Cryptography;
 using StellaOps.Plugin;
 
 namespace StellaOps.Concelier.Connector.Vndr.Adobe;
@@ -39,6 +40,7 @@ public sealed class AdobeConnector : IFeedConnector
     private readonly TimeProvider _timeProvider;
     private readonly IHttpClientFactory _httpClientFactory;
     private readonly AdobeDiagnostics _diagnostics;
+    private readonly ICryptoHash _hash;
     private readonly ILogger<AdobeConnector> _logger;
 
     private static readonly JsonSchema Schema = AdobeSchemaProvider.Schema;
@@ -61,6 +63,7 @@ public sealed class AdobeConnector : IFeedConnector
         TimeProvider? timeProvider,
         IHttpClientFactory httpClientFactory,
         AdobeDiagnostics diagnostics,
+        ICryptoHash cryptoHash,
         ILogger<AdobeConnector> logger)
     {
         _fetchService = fetchService ?? throw new ArgumentNullException(nameof(fetchService));
@@ -76,6 +79,7 @@ public sealed class AdobeConnector : IFeedConnector
         _timeProvider = timeProvider ?? TimeProvider.System;
         _httpClientFactory = httpClientFactory ?? throw new ArgumentNullException(nameof(httpClientFactory));
         _diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
+        _hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
     }
 
@@ -497,7 +501,7 @@ public sealed class AdobeConnector : IFeedConnector
 
             var payload = StellaOps.Concelier.Documents.DocumentObject.Parse(json);
             var dtoRecord = new DtoRecord(
-                Guid.NewGuid(),
+                ComputeDeterministicId(document.Id.ToString(), "adobe/1.0"),
                 document.Id,
                 SourceName,
                 "adobe.bulletin.v1",
@@ -754,4 +758,11 @@ public sealed class AdobeConnector : IFeedConnector
 
         return rules.Count == 0 ? Array.Empty<NormalizedVersionRule>() : rules.ToArray();
     }
+
+    private Guid ComputeDeterministicId(string source, string identifier)
+    {
+        var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
+        var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
+        return new Guid(hash.AsSpan()[..16]);
+    }
 }

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Adobe/Internal/AdobeCursor.cs

@@ -21,13 +21,13 @@ internal sealed record AdobeCursor(
             document["lastPublished"] = LastPublished.Value.UtcDateTime;
         }
 
-        document["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString()));
-        document["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString()));
+        document["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString()));
+        document["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString()));
 
         if (FetchCache is { Count: > 0 })
         {
             var cacheDocument = new DocumentObject();
-            foreach (var (key, entry) in FetchCache)
+            foreach (var (key, entry) in FetchCache.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
             {
                 cacheDocument[key] = entry.ToDocument();
             }

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Adobe/StellaOps.Concelier.Connector.Vndr.Adobe.csproj

@@ -5,6 +5,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>
@@ -17,7 +18,7 @@
 
   <ItemGroup>
     <ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
-
+    <ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
     <ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />
     <ProjectReference Include="../StellaOps.Concelier.Models/StellaOps.Concelier.Models.csproj" />
   </ItemGroup>