chore: adopt latest standards — gate house style in-build (§1.2.1, §5.2, §4.4, §2.7)

[StuartMeeks]

Catches this repo up to the NextIteration.Standards
changes landed 2026-08-21, after Splash's 2026-08-20 adoption reached 29/29.

Standards conformance only — this is not a release. <Version> stays 0.3.0 and the
CHANGELOG entries sit under [Unreleased]. Cutting 1.0.0 (version bump + tag) is left for
whenever the maintainer decides.

Changes

• §1.2.1 — EnforceCodeStyleInBuild=true (via the canonical Directory.Build.props).
• §5.2 — canonical .editorconfig: a deliberate allow-list of named style gates
  (braces always, var, System-first usings, full naming ruleset), byte-identical to the
  template.
• §4.4 — codeql.yml gains the query-filters block excluding cs/unmanaged-code and
  cs/call-to-unmanaged-code. No P/Invoke here, so it matches nothing; carried so the
  workflow stays identical to the template (§3.0.1).
• §2.7 — test project (and the demo, same conflict) add IDE0005 to NoWarn.
• Code brought to green under the flag: braces, var, using order, single-line
  expression bodies in tests, removal of gratuitous _ = discards per the estate house
  rule. Behaviour-preserving — no public API or rendered output changed; the single
  AnsiConsole.Markup render path and its markup escaping are untouched.

Verification

• dotnet build -c Release: 0 warnings, 0 errors under TreatWarningsAsErrors +
  EnforceCodeStyleInBuild.
• dotnet test -c Release: 80 passed, 0 failed (40 × net8.0 + 40 × net10.0).

Follow-up (not in this PR)

• §4.12 (CodeQL-gates-merge: require the analyze check + a code_scanning
  merge-protection rule) is branch-protection config, not a file change — needs
  apply-repo-settings.sh --with-required-checks, a maintainer action.

🤖 Generated with Claude Code