Summary

The headline change is migrating the analyzer stack from StyleCop (stylecop.analyzers 1.2.0-beta.556) to StyleSharp (StyleSharp.Analyzers 3.3.2) and bringing the entire solution — production and test projects — into compliance with the new rule set under -warnaserror. That compliance work is the bulk of this PR.

A few infrastructure cleanups and the CI additions ride along because the rule churn made them convenient to land together.

StyleCop → StyleSharp (the main change)

• Replaces stylecop.analyzers with StyleSharp.Analyzers 3.3.2 across all projects.
• Brings the production code into compliance with the SST* rules:
  • Documentation coverage — SST1600/1601/1602/1654 (exposed, internal, and private element docs) with the matching stylesharp.* settings.
  • Whitespace / blank-line rules — SST1505/1507/1518.
  • Summary single-line length (stylesharp.summary_single_line_max_length) and the wrapping/placement rules.
• Updates .editorconfig accordingly and disables the Roslynator rules StyleSharp now owns (RCS0058/0059/0063).

Test-project compliance (now part of this PR)

• Documents every private field/constant flagged by SST1600 across the production libraries and the test projects (SST1600 now enforces docs on private members).
• Refactors the SonarAnalyzer findings in the tests rather than suppressing them:
  • S109 / S1192 — names the repeated magic numbers and string literals (e.g. a shared NamedContract/count constants, the Drawing colour constants).
  • S2365 — the Log4Net mock's Logs property no longer copies a collection in the getter (extracted to a BuildLogs() method, keeping the interface property).
  • S100 — renames ARGB* test methods to Argb*.
• Extracts the duplicated logging-test literals into a shared LoggerTestConstants and links it into the logging-adapter test projects (fixes the resulting CS0234).
• Modernizes the test data sources to strongly-typed TUnit sources — removes the xUnit-era XUnitHelpers (object[] boxing) in favour of IEnumerable<KnownColor> and tuple sequences that TUnit unpacks directly.

CI: SonarCloud + CodeQL

• Adds SonarCloud and CodeQL Advanced workflows using the shared reactiveui/actions-common reusable workflows.
• SonarCloud excludes the tests/ and Benchmarks/ folders from analysis, coverage, copy-paste detection, and test detection; analysis is skipped automatically when SONAR_TOKEN is absent (e.g. forks).

Smaller cleanups landed alongside

• Compile-included polyfills/helpers — moved to src/Polyfills, compile-included into each assembly with per-TFM Using aliases (BCL types on net8+, polyfills on net4x). Drops production InternalsVisibleTo (kept only for test projects that white-box internals); adds AppLocator.RegisterResolverInitializer so Splat no longer reaches into Splat.Core internals.
• Disposables — references ReactiveUI.Disposables 3.0.0 and deletes the internal ActionDisposable/BooleanDisposable/CompositeDisposable copies, rewiring to the package types (ActionDisposable.Empty → EmptyDisposable.Instance, CompositeDisposable → MultipleDisposable).
• Public API tracking — switches from Verify/PublicApiGenerator to the Roslyn PublicApiAnalyzers with per-TFM baselines wired via Directory.Build.props.

Verification

• Linux: the full solution — including every test project — builds clean (0 errors / 0 warnings) with -warnaserror. TargetFrameworkExtensionsTests (27) and SplatColorTests (350) pass, confirming the new strongly-typed data sources bind correctly at runtime.
• Apple (.NET 11 preview 5 VM with real workloads): all 16 Splat.Drawing and Splat.AppCenter builds — net10/net11 × ios, maccatalyst, macos, tvos — pass with 0 compile errors and 0 analyzer diagnostics.
• CI: build (Linux/macOS/Windows), SonarCloud, and CodeQL run on this PR.