fix(analyzers): preserve non-CPM and image builds

Guard analyzer package references for the inline-version MCP tool and copy the SDK suggestion baseline into the Docker build context before restore.

Refs #15

Co-Authored-By: Codex <codex@openai.com>

Directory.Build.props

@@ -4,8 +4,8 @@
         <IncludeSourceRevisionInInformationalVersion>false</IncludeSourceRevisionInInformationalVersion>
         <AllowMissingPrunePackageData>true</AllowMissingPrunePackageData>
         <!-- Analyzer posture (ersatztv#15): enable the complete SDK rule set and the
-             threading analyzer in every project. The checked-in globalconfig keeps the
-             SDK baseline at suggestion; individually promoted rules become CI-blocking. -->
+             threading analyzer in every centrally managed project. The checked-in globalconfig
+             keeps the SDK baseline at suggestion; individually promoted rules become CI-blocking. -->
         <EnableNETAnalyzers>true</EnableNETAnalyzers>
         <AnalysisLevel>latest-All</AnalysisLevel>
         <EnableThreadingAnalyzers>true</EnableThreadingAnalyzers>

Directory.Build.targets

@@ -1,5 +1,7 @@
 <Project>
-    <ItemGroup>
+    <!-- Guard on CPM so the gitignored .mcp tool, which deliberately uses inline package
+         versions, does not inherit a versionless analyzer PackageReference. -->
+    <ItemGroup Condition="'$(ManagePackageVersionsCentrally)' == 'true'">
         <PackageReference
             Include="Microsoft.VisualStudio.Threading.Analyzers"
             Condition="'$(EnableThreadingAnalyzers)' == 'true'">
@@ -8,11 +10,11 @@
         </PackageReference>
     </ItemGroup>
 
-    <!-- Curated static-analysis packs (ersatztv#15), applied to every project. Versions are
-         central (Directory.Packages.props / CPM). Guarded on CPM so the gitignored .mcp tool
-         (which opts out of CPM) doesn't pull versionless references. They start at `suggestion`
-         severity in .editorconfig so they don't fail the TreatWarningsAsErrors build; high-value
-         rules are promoted to warning/error incrementally. -->
+    <!-- Curated static-analysis packs (ersatztv#15), applied to every centrally managed project.
+         Versions are central (Directory.Packages.props / CPM). Guarded on CPM so the gitignored
+         .mcp tool (which opts out of CPM) doesn't pull versionless references. They start at
+         `suggestion` severity in .editorconfig so they don't fail the TreatWarningsAsErrors build;
+         high-value rules are promoted to warning/error incrementally. -->
     <ItemGroup Condition="'$(ManagePackageVersionsCentrally)' == 'true'">
         <PackageReference Include="Roslynator.Analyzers">
             <PrivateAssets>all</PrivateAssets>

docker/Dockerfile

@@ -45,6 +45,7 @@ COPY *.sln .
 # local/CI builds. Directory.Packages.props is REQUIRED here: with CPM the csproj
 # carry no versions, so restore fails without the central manifest.
 COPY Directory.Build.props Directory.Build.targets Directory.Packages.props global.json .editorconfig ./
+COPY eng/analyzers/sdk-all-suggestion.globalconfig ./eng/analyzers/
 COPY artwork/* ./artwork/
 COPY ErsatzTV/*.csproj ./ErsatzTV/
 COPY ErsatzTV.Application/*.csproj ./ErsatzTV.Application/

docs/ci-cd.md

@@ -300,9 +300,12 @@ running product from outside our C#/review stack.
 ## Static analysis & formatting
 
 **Analyzers** — `Directory.Build.props` enables the SDK analyzers at `latest-All` and turns on
-`Microsoft.VisualStudio.Threading.Analyzers` for every project. `Directory.Build.targets` also references
+`Microsoft.VisualStudio.Threading.Analyzers` for every centrally managed project.
+`Directory.Build.targets` also references
 **Roslynator**, **SonarAnalyzer.CSharp**, **Meziantou.Analyzer**, and **AsyncFixer** repo-wide (versions
-central via CPM; guarded on `ManagePackageVersionsCentrally` so the gitignored `.mcp` tool isn't pulled in).
+central via CPM). All analyzer package references are guarded on `ManagePackageVersionsCentrally`, so the
+gitignored `.mcp` tool—which deliberately uses inline package versions—does not inherit versionless
+references.
 They are introduced **incrementally** (ersatztv#15). `eng/analyzers/sdk-all-suggestion.globalconfig`
 enumerates the .NET 10 SDK `All` inventory at `suggestion`; this exact-ID baseline is necessary because
 the SDK's generated `latest-All` severities outrank `.editorconfig` bulk settings. `.editorconfig` keeps
@@ -310,7 +313,7 @@ the threading and curated-pack baselines at `suggestion`. Diagnostics remain vis
 `dotnet format analyzers`, but do not create a wall of failures (a direct `latest-All` trial activated
 455 existing errors in the TWAE projects).
 
-**Promotion is the enforcement** — set an reviewed rule to `warning` in `.editorconfig` and append its ID
+**Promotion is the enforcement** — set a reviewed rule to `warning` in `.editorconfig` and append its ID
 to the central `WarningsAsErrors` list in `Directory.Build.props`. The explicit list makes the rule block
 in every project, including test projects that do not otherwise use TWAE. On a major SDK upgrade,
 regenerate the checked-in SDK baseline from `analysislevel_<major>_all.globalconfig`, preserve SDK `none`

docs/contributing.md

@@ -112,10 +112,11 @@ talks exclusively to the REST API. Every former Blazor route now 302-redirects t
   small, documented exemption list (e.g. `VSTHRD200`, `CA1873`); NuGet-audit `NU1901-1903` are demoted
   to warnings in `Directory.Build.props` while `NU1904` (critical) blocks.
 - **Static analysis is centralized**: `Directory.Build.props` enables the SDK analyzers at
-  `latest-All` plus the threading analyzer for every project; `Directory.Build.targets` adds Roslynator,
-  SonarAnalyzer, Meziantou, and AsyncFixer. The checked-in SDK globalconfig and `.editorconfig` keep the
-  broad baseline at `suggestion`. Promote one reviewed rule at a time by setting it to `warning` and
-  adding its ID to the central `WarningsAsErrors` list; never flip a wall of rules to error at once.
+  `latest-All` plus the threading analyzer for every centrally managed project; `Directory.Build.targets`
+  adds Roslynator, SonarAnalyzer, Meziantou, and AsyncFixer. Analyzer package references are CPM-guarded
+  so the gitignored `.mcp` tool retains its inline-version dependency model. The SDK globalconfig and
+  `.editorconfig` keep the broad baseline at `suggestion`. Promote one reviewed rule at a time by setting
+  it to `warning` and adding its ID to the central `WarningsAsErrors` list; never flip a wall of rules to error at once.
   Refresh the SDK globalconfig deliberately when moving to a new .NET SDK major. (ersatztv#15)
 
 ## 8. Testing