Migrate to xunit v3 and pin dependencies with lock files

[AlyxSharkBite]

Fixes the two remaining actionable items. Two independent concerns, kept as two separate commits — but in one PR, because the lock file content depends on the exact package set, so splitting them would guarantee a conflict.

---

1. xunit v2 → v3 (60dba84)

xunit v2 is marked Legacy in NuGet's advisory data, which the SCA workflow reported as a deprecation warning on every run.

No test source changes were needed. Fact, Theory, InlineData, MemberData, TheoryData, Assert and Record.Exception are all unchanged in v3. All 966 tests pass.

What did change is how tests are hosted. xunit v3 builds on Microsoft.Testing.Platform, so the test project is now an executable carrying its own runner, and the .NET 10 SDK no longer runs such projects through VSTest at all:

• global.json selects the MTP runner — the documented opt-in for the SDK's MTP mode of dotnet test
• Microsoft.NET.Test.Sdk and xunit.runner.visualstudio are gone; the platform runner replaces both
• coverlet.collector dropped with them — a VSTest data collector, and coverage was never collected in CI. Fewer packages is also less to audit.
• CI drops --nologo from dotnet test

That last one is worth calling out: MTP mode rejects --nologo with exit code 5, which surfaces as "Zero tests ran" rather than an obvious argument error. Easy to misread as a discovery failure.

Also set TESTINGPLATFORM_TELEMETRY_OPTOUT, since the platform ships its own telemetry package, and repointed Dependabot's test-dependencies group at Microsoft.Testing.* now that the old packages are gone.

Result: dotnet list package --deprecated --include-transitive is clean for both projects.

---

2. NuGet lock files (21fac37)

Closes the Scorecard Pinned-Dependencies finding (7/10, nugetCommand not pinned by hash). Restore previously resolved versions at build time, so a re-published or substituted package could enter a build unnoticed.

Directory.Build.props enables RestorePackagesWithLockFile repo-wide, and the generated packages.lock.json files are committed:

Project	Locked packages
PkLibSharp.Tests	18, all with content hashes
PkLibSharp	0 — the library genuinely has no dependencies

CI restores with --locked-mode in both the build and the SCA workflow.

I verified the gate actually fires rather than assuming it: changing a package version without regenerating the lock fails restore with NU1004 instead of quietly resolving the new version.

One honest limitation found while testing — editing resolved inside the lock file alone was not rejected, because that package was already in the local NuGet cache. Content hashes are verified when packages are downloaded, which is the CI case (clean runner, cold cache); a warm local cache can serve a package without re-checking it. So this is a strong CI gate and a weaker local one.

Finally, NuGetAuditMode=all makes restore audit transitive packages, not just direct references. The default covers only direct ones, which is not where most dependency risk lives.

---

Verification

• dotnet restore --locked-mode → clean
• dotnet build -c Release -warnaserror → 0 warnings, 0 errors
• dotnet test -c Release --no-build → 966 passed, 0 failed
• No vulnerable or deprecated packages in either project