Close the local SonarCloud calibration gap (S8969)

[matt-edmondson]

Fixes #88

What was left

The .sonarlint/ local reproduction already landed and works. The one acceptance criterion still
open was that its output match what SonarCloud reports for the same commit — it reported five
S2699 and missed a sixth issue that the previous attempt recorded as an unidentified gap, because
sonarcloud.io was unreachable from the sandbox at the time. It is reachable now, and the project is
public, so the dashboard could be read directly.

The missing issue

S8969 — "Null-forgiving operators should not be redundant" — on
CodeBlocker/Templates/DocComment.cs:191:

if (string.IsNullOrEmpty(text))
{
    return;
}

string[] lines = SplitLines(text!);   // <- the guard above already narrowed this

Why the severity line alone would not have worked

This is the part worth recording, because the previous note assumed the fix was a missing
severity entry. It was not, on its own. S8969 is both shipped disabled by default and
absent from the pinned SonarAnalyzer.CSharp 10.18.0.131500 — a rule the package does not carry
cannot fire however it is configured. I bisected the releases: 10.30.0.144632 is the first one
containing it, so the pin moves there (the smallest bump that works) and the severity line goes in
alongside.

That failure mode is now documented in both the globalconfig and CLAUDE.md: a rule that stays
silent locally after being listed is a package-version problem, not a severity problem.

Verification

Local run and SonarCloud now agree exactly, by file and line:

finding	location	SonarCloud	local
S2699	CodeBlocker.Test/CodeBlockerTests.cs:115	✔	✔
S2699	CodeBlocker.Test/CodeBlockerTests.cs:128	✔	✔
S2699	CodeBlocker.Test/CodeBlockerTests.cs:398	✔	✔
S2699	CodeBlocker.Test/ScopeTests.cs:98	✔	✔
S2699	CodeBlocker.Test/ScopeWithTrailingSemicolonTests.cs:98	✔	✔
S8969	CodeBlocker/Templates/DocComment.cs:191	✔	✔ (was ✘)

Before/after on the same tree confirms the change is what surfaces it: on main the same command
reports only the five S2699; with this branch it reports all six.

Against the issue's acceptance criteria:

• A documented local command runs the Sonar analyzers over every project
• Its output matches what SonarCloud reports for the same commit, including the outstanding
  issue from Generalize CodeBlocker into a code-generation substrate #87
• Nothing imports the config automatically — a plain dotnet build reports 0 Sonar
  diagnostics, and dotnet test passes 171/171

Scope

Calibration only. The S8969 finding itself is now visible locally but is deliberately left
unfixed — this PR is about making the reproduction faithful, not about changing library code, and
the finding is useful as live evidence that the two sides agree. Worth a follow-up to drop the
redundant !.

The repo's .gitignore had an unrelated local modification during this session; it is not part of
this branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FUReBqNhW1FferSYkYG9Gd

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud