build: update CsWinRT to 2.3.0-prerelease + apply OSClient defaults

[jevansaks]

Summary

Pin Microsoft.Windows.CsWinRT to 2.3.0-prerelease.251115.2 (latest 2.3.x; no stable 2.3 released yet) and apply the subset of CsWinRT defaults from OSClient's UES.Common.CSharp.SDK.props that make sense for a pure WinAppSDK repo.

Before this change, the repo picked up CsWinRT only transitively from Microsoft.WindowsAppSDK 2.0.1, which dragged in an old 2.0.x build and missed two years of generator/analyzer improvements.

Why

• Stay current with the CsWinRT generator — newer projection code, better diagnostics, AOT/trimming improvements that ship in 2.3.
• Stop floating on whatever WinAppSDK happens to bundle. Pin once in Directory.Build.props and every WinUI project picks it up automatically.
• Adopt OSClient's vetted defaults so we benefit from the same CsWinRT settings that ship Windows.

CsWinRT defaults applied

Centralized in Directory.Build.props, gated on UseWinUI=true:

Property	Value	Why
CsWinRTEnableLogging	true	Verbose CsWinRT diagnostics in the build log.
CsWinRTIIDOptimizerOptOut	true	We don't author projections — IID patching is overhead for consumers.
CsWinRTUseEnvironmentalTools	false	Don't pick up a side-by-side UWP toolset that may exist on a dev box; matches CI/lab.
CsWinRTLoadComponentsInDefaultALC	true	Avoids ALC-isolation breaking JIT-mode test/sample apps.

The Microsoft.Windows.CsWinRT PackageReference lives in Directory.Build.targets behind the same UseWinUI=true condition, with PrivateAssets="all" because it's a build-time generator.

Defaults intentionally not applied (with rationale in plan.md)

• ReportAnalyzer=true — analyzer-timing reports are noisy/expensive for a smaller repo.
• CsWinRTGenerateManagedDllGetActivationFactory=true — only useful for AOT-merged WinRT components; nothing here authors WinRT components.
• The UseUwp / CsWinRTUseWindowsUIXamlProjections=false / EnableUnsafeMixedMicrosoftWindowsUIXamlProjections=true cluster — these turn on UWP/OS-XAML mixing, which is OSClient-specific. We're a pure WinAppSDK repo.
• DisableRuntimeMarshalling=true — wide-blast-radius assembly attribute, separate work.

Cleanup driven by the upgrade

CsWinRT 2.3 introduces CsWinRT1032 (collection literals targeting non-mutable WinRT-projected interfaces aren't AOT-safe) and CsWinRT1033 ([ComImport] casts aren't compatible with CsWinRT/AOT). 144 new warnings appeared.

Product code (5 sites, fixed properly)

• src/Reactor/Charting/Charts.cs (3)
• src/Reactor/Charting/Charts.Tree.cs (2)

These implement IReadOnlyList<ChartSeriesDescriptor>/IReadOnlyList<ChartAxisDescriptor> properties returning collection expressions. Cast to T[] so the analyzer knows the concrete type.

Sample code (~10 sites, fixed properly)

• samples/TodoApp/Program.cs, samples/Reactor.TestApp, four samples/ReactorCharting.Gallery/Samples/*.cs files.

Same (T[])[...] cast pattern at the call sites.

Test code (tests/Reactor.Tests, tests/Reactor.AppTests.Host): suppressed CsWinRT1032/CsWinRT1033 with rationale comment

These tests:

1. Call managed Reactor APIs directly — no WinRT projection ABI in the path.
2. Are never AOT-published.

So the warnings don't apply, and rewriting 100+ test sites with (T[])[...] casts is significant churn for zero runtime benefit. The suppression is documented in each .csproj next to the NoWarn line.

Pre-existing baseline issue fixed

• src/Reactor/Hosting/ReactorHostControl.cs:360 — _logger.LogWarning(...) (CS8604) made null-conditional like every other call site in the file.

Build state

	Errors	Warnings
Baseline (main)	0	19
After this PR	0	17

Remaining 17 warnings are all pre-existing:

• 10× REACTOR_A11Y_001/002/003 in samples/apps/a11y-showcase — intentional analyzer-demo (per code comments)
• 3× NU1903 Nerdbank.MessagePack 1.0.2 vulnerability — transitive from GitHub.Copilot.SDK 0.1.32, out of scope

Test plan

• dotnet build Reactor.sln — 0 errors, 17 warnings (all pre-existing)
• dotnet test tests/Reactor.Tests — 6820 pass, 1 fail, 46 skipped
  • The single failure (IntlAccessorTests.FormatDate_Short_ReturnsShortDate) is pre-existing on main: .NET 10 ICU returns "2026-01-15" for en-US short date format, the test still expects "1/15/2026". Same root cause as PR fix: locale and environment-sensitive test failures #169. Verified by git stash + re-run.
• dotnet test tests/Reactor.SelfTests — 671/671 pass
• E2E (tests/Reactor.AppTests) not run — requires WinAppDriver, not part of the standard PR loop.

Risk / breaking changes

• All consumers of the framework now get CsWinRT 2.3 generator output instead of 2.0. This is a build-time generator, so no runtime ABI shift; the projections it produces are still WinRT-callable.
• Test/sample projects suppress two CsWinRT analyzer rules. New product code is unaffected because the suppression is scoped to the test .csproj files only.