fix: ship XML documentation in every package (#156)

[swimmesberger]

Closes #156.

Directory.Build.props never set GenerateDocumentationFile, so every published package contained only the assembly and consumers got no IntelliSense, hover text or parameter help for any Elarion API. That surface matters more here than usual: handlers, source generators and analyzers mean the API is discovered rather than browsed, and a coding agent in a consuming repo reads exactly the metadata IntelliSense reads.

What changed

A new src/Directory.Build.props enables it for everything under src/, so tests, benchmarks and samples — which document nothing and would have contributed ~2,600 CS1591 — are unaffected. The SDK packs $(AssemblyName).xml into lib/$(TargetFramework) on its own: 53 of the 54 packages that ship a lib/ assembly now carry one.

The issue anticipated needing a blanket NoWarn CS1591. It turned out not to: the shipped source is almost fully documented. Only 26 missing comments in packable projects (JsonRpcIdKind/JsonRpcIdInfo, the HTTP body binder's BodyFailure, SqlInterpolatedStringHandler, SqlStatement.ToString, the stream decorators, ElarionSqlJsonInstaller, ElarionFileJsonConverter) plus 20 generator Initialize overrides, all filled in.

Turning documentation on also surfaced ~48 doc defects that had been invisible, including crefs to members that no longer exist:

• TcpConnectionHandler.ConfigureConnectionAsync and WebSocketConnectionHandler.ConfigureConnectionAsync — per-connection settings come from Settings on the session types
• TcpOutboundWriter.WriteFrameAsync — never existed; the mirror is the batched drain loop
• IAuthorizationPolicy.Name — the name lives on [AuthorizationPolicy] or the registration call, as that interface's own summary says

plus crefs that never resolved across the Abstractions/core boundary (the pipeline decorators live in core, which Abstractions must not reference) and paramref/typeparamref tags naming parameters their type does not have.

Beyond the issue

Generated code now emits #pragma warning disable CS1591 after #nullable enable. Without it, a consumer who acts on this very issue and turns on GenerateDocumentationFile inherits 156 warnings from Elarion's own generated output — as errors, under their TreatWarningsAsErrors.

Unrelated, but blocking

Microsoft.SourceLink.GitHub was pinned at 10.0.300, which pulls Microsoft.Build.Tasks.Git 10.0.300 — now flagged by CVE-2026-62900 (GHSA-23fw-v26w-5fgq). With NuGetAudit and TreatWarningsAsErrors that is 108 NU1902 build errors and 3 test failures on main today, independent of this change. Bumped to 10.0.401 (patched from 10.0.303) so the validation baseline can run at all.

Verification

• dotnet build Elarion.slnx -c Release — warning-free, with TreatWarningsAsErrors and audit both on
• dotnet test — 2047/2047 pass
• dotnet pack — clean; analyzer assets still pack correctly alongside the new .xml