feat(audit): Apply TreatWarningsAsErrors=true to 160+ production csproj files

Sprint: SPRINT_20251229_049_BE_csproj_audit_maint_tests
Tasks: AUDIT-0001 through AUDIT-0147 APPLY tasks (approved decisions 1-9)

Changes:
- Set TreatWarningsAsErrors=true for all production .NET projects
- Fixed nullable warnings in Scanner.EntryTrace, Scanner.Evidence,
  Scheduler.Worker, Concelier connectors, and other modules
- Injected TimeProvider/IGuidProvider for deterministic time/ID generation
- Added path traversal validation in AirGap.Bundle
- Fixed NULL handling in various cursor classes
- Third-party GostCryptography retains TreatWarningsAsErrors=false (preserves original)
- Test projects excluded per user decision (rejected decision 10)

Note: All 17 ACSC connector tests pass after snapshot fixture sync

src/Policy/__Libraries/StellaOps.Policy/Gates/EarnedCapacityReplenishment.cs

@@ -78,7 +78,7 @@ public sealed class EarnedCapacityEvaluator
             return EarnedCapacityResult.NotEligible(
                 serviceId,
                 EarnedCapacityIneligibilityReason.NoImprovement,
-                improvementCheck.Reason);
+                improvementCheck.Reason ?? "No improvement detected");
         }
 
         // Calculate recommended increase based on improvement magnitude