chore(ci): modernize workflows to net10.0 with a composite build action

[dotnetcadet]

Summary

Modernizes CI for the restructured, net10.0 repo. The five stale .NET 6/7/8
per-library workflows (actions v1/v2, pre-restructure paths filters, per-push
nuget.org publishing) are replaced with a shared composite build action and
one workflow per area plus a full-.slnx integration build — the Cohesion N-01
pattern. Actions are v4/v5, runners are ubuntu-latest, and every paths filter
targets the current libraries/<Name>/{src,tests} layout.

This is a foundation delivery — it does not complete #70; that issue stays open. The build is the
required gate everywhere, and the two things that cannot pass today are isolated
and loud rather than swallowed. But two of #70's acceptance criteria are
deferred, not delivered, so #70 stays open (see "Work items" below).

Changes

• .github/actions/build/action.yml — composite action: resolves the pinned
  SDK from global.json (sourced comment-tolerantly — global.json is JSONC and
  setup-dotnet's global-json-file uses a strict parser), then restore → build
  (-p:TreatWarningsAsErrors=false, i.e. -warnaserror off, so the tree's ~1k
  CS1591 doc warnings never gate) → optional dotnet test. Two documented
  escape hatches — allow-build-failure and allow-test-failure — downgrade a
  failure to a ::warning annotation instead of hiding it.
• Per-area workflows — ograph-core, ograph-gdm, ograph-syntax,
  ograph-client, ograph-server, ograph-analyzers, ograph-tooling. Each has
  correct paths filters (global.json, Directory.Build.props/.targets,
  build/**, its own area folder, .github/actions/build/**, its own workflow
  file).
• ograph-solution.yml — builds the full .slnx on push to main/development
  and on every PR. Mechanism: enumerate the projects declared in the .slnx and
  build each, skipping only the projects that cannot produce a green build on
  ubuntu (Server, and the two net472 projects). An isolated non-blocking job
  builds Server separately. Note: this aggregate required job is build-only —
  it does not run dotnet test (test promotion is tracked in [O01.01.12.01.01] Restore red/empty test suites and promote CI tests to a required gate #90).
• Server isolated & non-blocking — Server has ~37 pre-existing compile errors
  (deferred feature work, roadmap N-08). Its job is continue-on-error: true and
  the composite emits a loud warning annotation, so it never masks a regression in
  a required area. Remove the switches once Server compiles.
• Test suites non-blocking (pending [O01.01.12.01.01] Restore red/empty test suites and promote CI tests to a required gate #90) — discovered during this work: the
  Gdm (2 failing) and Syntax (9 failing) suites are pre-existing red and the
  Client/Cli test projects are empty stubs. Tests run and surface as annotations
  but do not gate yet — so [O01.01.12.01] Modernize CI to net10.0 with matrix and composite build action #70's "green on build + existing tests" criterion is
  not yet satisfied. Filed [O01.01.12.01.01] Restore red/empty test suites and promote CI tests to a required gate #90 to make them green and promote tests to a
  required gate. Library source is owned by other lanes, so it is untouched here.
• net472 matrix extension point — the VSIX and the analyzer test host target
  net472 and cannot build/run on ubuntu. They are excluded from the ubuntu gate,
  with a documented windows-latest matrix leg for when their tests are ready.
  No strategy.matrix ships in this PR (it exists only as a commented example in
  ograph-analyzers.yml), so [O01.01.12.01] Modernize CI to net10.0 with matrix and composite build action #70's "matrix builds" criterion is not yet satisfied;
  the windows-latest leg is tracked in [O01.01.12.01.01] Restore red/empty test suites and promote CI tests to a required gate #90.
• NuGet publishing dropped — the old workflows pushed to nuget.org on every
  main push; packages are not ready, so that is not carried over. A commented
  release-job stub remains in ograph-solution.yml, with a roadmap note.
• Deleted the five stale ograph-*.yml workflows.
• docs/DELIVERY_ROADMAP.md — CI status row updated to record the
  modernization as a foundation ([O01.01.12.01] Modernize CI to net10.0 with matrix and composite build action #70 still open), the two deferred acceptance
  criteria, the Server/test non-blocking posture, the matrix extension point, and
  the NuGet decision.

Work items

Refs #70 — does NOT close it. Delivered here: net10.0, actions v4/v5, the
shared composite build action, and correct paths filters. Deferred (so #70
stays open): "green on build + existing tests" (test suites run non-blocking under
allow-test-failure, not gated) and "matrix builds" (all jobs are single-runner
ubuntu-latest). #70 is wired blocked-by #90 and should be promoted to Done
only after #90 lands.

#90 — restore the red/empty test suites, remove allow-test-failure so tests
become a required gate, and add the windows-latest net472 matrix leg. This closes
out the two deferred #70 criteria.

Testing & verification

• actionlint v1.7.12 — clean (exit 0) across all eight workflows.
• YAML — all workflows + the composite action parse cleanly.
• Paths filters — every referenced path verified to exist in the tree; each
  workflow's self-reference matches its filename (ograph-solution intentionally
  has no paths filter — it is the aggregate gate).
• .slnx exclusion loop — dry-run confirms it builds all 15 buildable
  projects and skips exactly Server (×2), the VSIX, and the net472 analyzer test
  host.
• Composite logic exercised locally against real projects: Core (build-only) →
  success; Gdm (build ok, tests fail, allow-test-failure) → success + warning;
  Server (build fails, allow-build-failure) → success + warning; and the
  negative case (Gdm with the switch off) → correctly fails (rc=1), proving the
  gate still gates.
• Line endings — workflow blobs are committed LF, so the composite/solution
  bash runs cleanly on ubuntu.
• CI proof runs on this PR; statuses reported after the runs complete.

🤖 Generated with Claude Code