fix: resolve CS8032 assembly version mismatch (#850) (#888)

Fixes #850. The analyzer was broken for all users on v0.4.0 because the
shipped DLLs referenced `System.Collections.Immutable` versions that
don't exist in the user's compiler host:

- `Moq.Analyzers.dll` referenced SCI **10.0.0.0** (via transitive pin
from Renovate PR #822)
- Bundled `AnalyzerUtilities.dll` (v4.14.0) referenced SCI **9.0.0.0**
- .NET 8 SDK hosts only provide SCI **8.0.0.0**, causing CS8032 on every
build

- Downgrade SCI transitive pin: 10.0.0 -> 8.0.0
- Downgrade AnalyzerUtilities: 4.14.0 -> 3.3.4 (its bundled DLL also
referenced SCI 9.0.0.0; v3.3.4 references SCI 1.2.3.0, compatible with
all hosts)
- Add SCI `VersionOverride` in Benchmarks project (not shipped, needs
higher version for TraceEvent)

| Layer | What | When |
|-------|------|------|
| MSBuild target | `ValidateAnalyzerHostCompatibility` in
Packaging.targets | Every build (local + CI) |
| Unit test | `AnalyzerAssemblyCompatibilityTests` checks all 3 shipped
DLLs | Every test run |
| Renovate rule | `automerge: false` + `analyzer-compat` label for SCI,
SRM, AnalyzerUtilities | Every Renovate PR |
| Dependabot ignore | SCI + System.Reflection.Metadata added to ignore
list | Dependabot scheduling |
| Comments | Warning in Directory.Packages.props | Human reads the file
|

```
Moq.Analyzers.dll         -> SCI 8.0.0.0  (was 10.0.0.0)
Moq.CodeFixes.dll         -> SCI 8.0.0.0
AnalyzerUtilities.dll     -> SCI 1.2.3.0  (was 9.0.0.0)
```

- [x] Build succeeds with 0 errors, 0 warnings
- [x] All 1928 existing tests pass (no regressions)
- [x] 3 new `AnalyzerAssemblyCompatibilityTests` pass
- [x] Assembly references verified: all shipped DLLs reference SCI <=
8.0.0.0
- [ ] CI passes
- [ ] Manual: reference locally-built nupkg from a net8.0 project,
confirm no CS8032

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

* **Tests**
* Added analyzer assembly compatibility tests to verify shipped
analyzers load correctly across supported hosts.

* **Documentation**
* Enhanced contribution guide with instructions for running CI workflows
locally.

* **Chores**
* Added CI build/test/load-test steps and standardized artifact handling
and matrices.
* Enforced packaging checks and updated dependency pins; added tooling
overrides and a Renovate rule requiring manual review for
analyzer-related dependency updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: 3 people

.github/dependabot.yml

@@ -25,3 +25,8 @@ updates:
       - dependency-name: "Microsoft.CodeAnalysis.CSharp.Workspaces"
       - dependency-name: "Microsoft.CodeAnalysis.Common"
       - dependency-name: "Microsoft.CodeAnalysis.Workspaces.Common"
+      # Analyzer-shipped BCL packages must match minimum supported SDK host.
+      # See: https://github.com/rjmurillo/moq.analyzers/issues/850
+      - dependency-name: "System.Collections.Immutable"
+      - dependency-name: "System.Reflection.Metadata"
+      - dependency-name: "Microsoft.CodeAnalysis.AnalyzerUtilities"