fix: MA0002 ordinal comparisons and CS8602 nullable derefs

[JerrettDavis]

Summary

This PR bundles the same 16 NuGet package bumps as #568 (Meziantou.Analyzer, NSubstitute, bunit, AWSSDK.SecretsManager, StackExchange.Redis, JD.SemanticKernel.* connectors, etc.) plus the fixes required for the resulting build breakage, so it can merge standalone and unblock #568 to rebase cleanly.

Root cause 1 — MA0002 (80 sites, 32 files)

Meziantou.Analyzer 3.0.12x → 3.0.138 enforces MA0002: string-comparison APIs (Assert.Contains, Assert.NotEqual, OrderDescending, etc. over IEnumerable<string>) must specify an explicit IEqualityComparer<string>/IComparer<string>. Fixed by adding StringComparer.Ordinal at each flagged call site — this is behavior-preserving since it matches .NET's default ordinal semantics for Contains/equality; the one exception is CheckpointingSteps.cs's cpDirs.OrderDescending(), where the previous default was culture-sensitive ordering (via string.CompareTo), so switching to StringComparer.Ordinal is technically a (safe, deterministic) semantic change, called out here for visibility.

Root cause 2 — CS8602 / CS8604 (42 + 1 sites, 15 files) — CONFIRMED NSubstitute 6.0.0

NSubstitute 5.3.0 → 6.0.0 added nullable reference annotations to Arg.Is<T>/Arg.Any<T> predicate parameters and CallInfo.Arg<T>(), so lambda parameters and captured mock arguments that were implicitly non-null before are now T?, surfacing real (if practically unreachable) CS8602/CS8604 warnings that CI's TreatWarningsAsErrors (set only when CI=true, matching GitHub Actions) promotes to build errors. Verified directly: e.g. Arg.Is<Type>(t => t.IsGenericType ...) and callInfo.Arg<SubagentConfig>().Name — both APIs from NSubstitute, both newly nullable.

Fix approach, in order of preference per site:

• Multi-statement callback lambdas (.Returns(callInfo => { ... })) — added Assert.NotNull(config) (xUnit) or x.Should().NotBeNull() (FluentAssertions, matching each file's existing style) immediately after capturing the mock argument, before use. ~15 sites.
• Single-expression predicate lambdas (Arg.Is<T>(x => x.Foo == ...)) — used the null-forgiving operator x! on first use, since restructuring a matcher predicate into a block body just to assert would be invasive and semantically odd (an assert throwing during argument-matching, rather than at the normal test-failure point). ~28 sites.

One CS8604 site (MultiTurnExecutorTests.cs:324, new ChatHistory(history) where history = callInfo.Arg<ChatHistory>()) is the same root cause manifesting as a different diagnostic code; fixed identically with history.Should().NotBeNull(). Confirmed via a baseline build of main (pre-bump) with CI=true: zero MA0002/CS8602/CS8604 anywhere — all of this is 100% attributable to the bump.

Verification

• dotnet build -c Release (with CI=true, matching GitHub Actions' default env, which is what actually turns these into build-breaking errors): 0 warnings, 0 errors.
• dotnet test -c Release: all suites pass except two pre-existing, unrelated flaky/environmental failures, confirmed present on the unmodified bump branch before this fix (i.e., not introduced by it):
  • JD.AI.Tests.Workflows.MlNetIntentClassifierTests (~10-11 of many parameterized cases, count varies run-to-run) — ML.NET intent-classifier confidence-threshold flakiness, unrelated to any file touched here.
  • JD.AI.E2E.Tests.SessionScenarioTests.GetAuditEvents_ReturnsOk — requires external service state.

Files touched

47 test files only (no production/src code touched) — see diff for the full list. No refactoring, formatting, or unrelated cleanup; every change is either , StringComparer.Ordinal / , StringComparer.Ordinal) added to an existing call, or a null-forgiving ! / Assert.NotNull / .Should().NotBeNull() guard added immediately before a now-nullable-annotated NSubstitute value is dereferenced.

Unblocks #568 — once this merges, #568 can rebase cleanly onto a green main.

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Code Coverage

Summary
  Generated on: 08/04/2026 - 06:18:12
  Coverage date: 08/04/2026 - 06:16:03 - 08/04/2026 - 06:18:03
  Parser: MultiReport (7x Cobertura)
  Assemblies: 23
  Classes: 1067
  Files: 591
  Line coverage: 74.6%
  Covered lines: 36830
  Uncovered lines: 12484
  Coverable lines: 49314
  Total lines: 97285
  Branch coverage: 61.8% (13933 of 22512)
  Covered branches: 13933
  Total branches: 22512
  Method coverage: 86.3% (6313 of 7308)
  Full method coverage: 74.1% (5421 of 7308)
  Covered methods: 6313
  Fully covered methods: 5421
  Total methods: 7308

[github-actions]

Test Results

7 641 tests   7 622 ✅  2m 28s ⏱️
    7 suites     19 💤
    7 files        0 ❌

Results for commit 8fa63ff.