chore: modernize temp-path handling, harden ProcessRunner + Tesseract output

[ANcpLua]

Summary

• OcrService — replace ad-hoc Path.GetTempPath() + Guid files with a single Directory.CreateTempSubdirectory(\"createpdf-ocr-\") per OCR run. One atomic 0700-perms dir, one Directory.Delete(recursive: true) cleanup, no name-collision race window. Extracted a private OcrAsync(pdfPath, workDir, …) helper so the stream + file paths share the pipeline without nesting two temp dirs. Dropped now-unused TryDeleteFile in favor of TryDeleteDirectory.
• ProcessRunner — Process.Start(startInfo)! was a footgun: the docs say Process.Start can return null when a process resource is reused under UseShellExecute=true. Today we don't, but the ! would silently NRE the first time anyone flips that. Replaced with a real null-check that throws InvalidOperationException naming the offending FileName.
• TesseractOcrProvider — txtPath[..^4] hardcoded a 4-char .txt suffix. Swapped for Path.GetDirectoryName + Path.GetFileNameWithoutExtension so the base path is correct for any extension and won't silently corrupt the path on malformed inputs.
• Tests — replaced the two Path.GetTempFileName() callers (Microsoft now discourages it: predictable 8.3 name, TOCTOU surface, 65535-file-per-dir cap) and the Path.Combine(Path.GetTempPath(), guid) site with CreateTempSubdirectory + Delete(recursive: true). Rewrote TryDeleteFile_* tests as TryDeleteDirectory_* with a populated-then-deleted recursive case.

Coverage held at 100% — 229/229 lines, 245 tests, all green on net10.0 (multi-target net8/net9/net10 also build clean).

Observations on the other internals you flagged

• RuntimeSystemEnvironment.cs — clean wrapper, nothing to do.
• FileOperations.cs — FindProjectRoot walks up from AppContext.BaseDirectory looking for .csproj/.sln. That's a dev-mode heuristic — when consumers run a published binary in prod, there's no project file adjacent, so it falls back to Directory.GetCurrentDirectory(). Works fine, but it's a design choice worth noting (not a bug). Left as-is.
• TesseractOcrProvider — beyond the [..^4] fix, there's a minor asymmetry: line 62 reads _systemEnvironment.FileExists(txtPath) but line 65 does concrete File.ReadAllTextAsync(txtPath). The abstraction is half-applied. Out of scope for this PR.
• ProcessRunner — null-guard added, no other smells.

Test plan

• dotnet build clean across net8.0, net9.0, net10.0
• dotnet test --framework net10.0 — 245/245 pass
• dotcov report --exclude-generated against the cobertura output — 100% (229/229) line coverage
• CI: GitHub Actions verifies all three TFMs

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (6)

• CreatePdf.NET.Tests/DocumentTests.cs is excluded by none and included by none
• CreatePdf.NET.Tests/OcrServiceTests.cs is excluded by none and included by none
• CreatePdf.NET.Tests/RuntimeSystemEnvironmentTests.cs is excluded by none and included by none
• CreatePdf.NET/Internal/OcrService.cs is excluded by none and included by none
• CreatePdf.NET/Internal/ProcessRunner.cs is excluded by none and included by none
• CreatePdf.NET/Internal/TesseractOcrProvider.cs is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0c681579-5e48-44e5-ba1c-ce5515a05416

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR modernizes temporary-path handling across OCR code paths and tests, and adds defensive hardening around process startup and Tesseract output path derivation.

Changes:

• Use Directory.CreateTempSubdirectory(...) to allocate a per-run working directory for OCR and clean it up with a single recursive delete.
• Add a null-guard for Process.Start(...) in ProcessRunner.
• Replace Tesseract output base-path derivation from string slicing to Path-based APIs, and update tests to avoid Path.GetTempFileName().

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
CreatePdf.NET/Internal/TesseractOcrProvider.cs	Adjusts how the Tesseract output base path is derived from the requested txt output path.
CreatePdf.NET/Internal/ProcessRunner.cs	Replaces null-forgiving Process.Start(...)! with an explicit null-check + exception.
CreatePdf.NET/Internal/OcrService.cs	Creates one temp subdirectory per OCR run and deletes it recursively; introduces OcrAsync(...) helper.
CreatePdf.NET.Tests/RuntimeSystemEnvironmentTests.cs	Updates temp-file usage to a temp subdirectory + explicit probe file.
CreatePdf.NET.Tests/OcrServiceTests.cs	Updates cleanup helper tests from file deletion to recursive directory deletion.
CreatePdf.NET.Tests/DocumentTests.cs	Updates temp output location to a temp subdirectory and deletes it in finally.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.