fix(ci): review-hinweise fachlich abarbeiten und governance haerten

[tomtastisch]

Ziel & Scope

Diese PR arbeitet die zutreffenden Review-Hinweise fachlich ab und haertet den Workflow/Code ohne Scope-Drift:

• Qodana-Workflow fuer trusted vs. untrusted PR-Kontexte korrigiert,
• Duplikate/Dead-Code in ArchiveInternals.vb bereinigt,
• Governance-Regel in AGENTS.md verbindlich verschaerft (kein sinnfreies Resolven).

Umgesetzte Aufgaben (abhaken)

• Qodana-Job-Guard fuer Fork/Dependabot in .github/workflows/qodana.yml wiederhergestellt.
• Fail-closed Token-Assert fuer trusted Kontexte beibehalten.
• SharpCompress-Helper in ArchiveInternals.vb in gemeinsame Kompat-Klasse extrahiert.
• Doppelte Helper-Funktionen (HasGZipMagic, OpenArchiveCompat) entfernt.
• Ungenutzte Funktion TryProbeEntrySizeWithinLimit entfernt.
• Doku DE/EN fuer Qodana-Gate auf trusted-Kontext-Scope praezisiert.

Nachbesserungen aus Review (iterativ)

• Copilot-Hinweis zu Duplikaten in ArchiveInternals.vb umgesetzt.
• Copilot-Hinweis zu Dead-Code umgesetzt.
• Codex-Hinweis zu Secret-losen PR-Kontexten (Fork/Dependabot) umgesetzt.
• Begruendung fuer Coverage-Schwelle direkt im Script dokumentiert.
• Begruendung fuer PackageBacked.Tests TFM-Wahl (net10.0) im .csproj dokumentiert.
• AGENTS.md erweitert: Threads nur nach fachlicher Bearbeitung resolven.

Security- und Merge-Gates

• security/code-scanning/tools: Zielzustand vor Merge ist 0 offene Alerts.
• Merge nur bei gruenen Required Checks, ohne offene Review-Threads und mit mergebarem PR-Status.
• Qodana bleibt fail-closed in trusted Kontexten; untrusted PR-Kontexte (Fork/Dependabot) sind explizit ausgenommen.

Evidence (auditierbar)

• python3 tools/check-docs.py -> Doc check OK
• dotnet build FileClassifier.sln -c Release --no-restore -> 0 Fehler, 0 Warnung(en)
• dotnet test tests/FileTypeDetectionLib.Tests/FileTypeDetectionLib.Tests.csproj -c Release --no-restore --filter "FullyQualifiedName~ArchiveInternals|FullyQualifiedName~SharpCompressArchiveBackendUnitTests|FullyQualifiedName~UnifiedArchiveBackendUnitTests" -> 65/65 erfolgreich
• dotnet test tests/PackageBacked.Tests/PackageBacked.Tests.csproj -c Release --no-restore -f net10.0 -> 2/2 erfolgreich

DoD (mindestens 2 pro Punkt)

Punkt	DoD A	DoD B
Qodana-Guard korrekt	Fork/Dependabot-Guard im Workflow vorhanden	Token-Assert bleibt fail-closed fuer trusted Runs
Archive-Internals bereinigt	Helper-Duplikate sind entfernt und zentralisiert	Dead-Code ist entfernt und relevante Tests sind gruen
Governance-Schaerfung	AGENTS.md verbietet unfachliches Thread-Resolven explizit	Regel ist committed/pushed und damit repo-verbindlich

[Copilot]

Pull request overview

This PR addresses review feedback by hardening CI governance and eliminating code duplication in archive handling. The changes focus on three main areas: correcting the Qodana workflow to properly handle untrusted PR contexts (forks and dependabot), consolidating duplicate SharpCompress helper functions into a shared compatibility class, and strengthening governance rules around review thread resolution.

Changes:

• Added fork/dependabot guard to Qodana workflow to exclude untrusted PR contexts from secret-dependent checks while maintaining fail-closed behavior for trusted contexts
• Refactored duplicate SharpCompress helper functions (OpenArchive, OpenArchiveForContainer, HasGZipMagic, OpenGZipArchive) into shared ArchiveSharpCompressCompat class
• Removed unused dead code (TryProbeEntrySizeWithinLimit) and updated all references across ArchiveTypeResolver and SharpCompressArchiveBackend classes
• Added inline documentation explaining coverage threshold baseline and test project framework requirements
• Strengthened AGENTS.md governance to require substantive work (code/test/doc changes with evidence or justified rebuttal) before resolving review threads

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/qodana.yml	Added job-level condition to exclude fork and dependabot PRs from Qodana execution; updated comment to clarify fail-closed behavior applies to trusted contexts only
src/FileTypeDetection/Infrastructure/ArchiveInternals.vb	Introduced ArchiveSharpCompressCompat class to centralize duplicate SharpCompress helper functions; removed duplicate implementations from ArchiveTypeResolver and SharpCompressArchiveBackend; deleted unused TryProbeEntrySizeWithinLimit function
docs/ci/101_PIPELINE_CI.MD	Updated English documentation to reflect Qodana workflow changes and clarify trusted vs untrusted context behavior
docs/ci/001_PIPELINE_CI.MD	Updated German documentation to match English changes for consistency
AGENTS.md	Added explicit rule requiring substantive response before resolving review threads to prevent procedural-only resolutions
tools/run-coverage.sh	Added comment explaining coverage threshold baseline and future improvement plan
tests/PackageBacked.Tests/PackageBacked.Tests.csproj	Added comment explaining net10.0 framework requirement for package-backed xUnit v3 execution