#126 Drop WinForms so Release MSIX can trim

Summary

• Replace WinForms folder/file dialogs and clipboard with Win32/COM interop in CmdPal and Run hosts, and swap Core's WinForms dependency for System.Drawing.Common (icon cache only).
• Re-enable Release MSIX trimming (PublishTrimmed) with an ILLink root for QuickShellExtension, plus trim-safe source-generated JSON for form choices.
• Keep workspace trust digests byte-stable via a dedicated QuickShellDigestJsonContext (compact + nulls) and a parity test against the old anonymous Serialize shape.
• Fix release-note doc links that pointed at nonexistent main (master is the default branch).

Test plan

• dotnet test security/digest filters (Debug): ComputeDigest_matches_legacy + WorkspaceSecurityPolicyTests + adversarial
• dotnet build QuickShell.Run Release x64
• dotnet build QuickShell Release x64 with WinGetBuild=true
• Trimmed Release MSIX build via VS MSBuild (Scoop dotnet build -c Release hits MSB4216 ILLink task-host locally)
• Smoke: folder picker, export/import JSON picker, companion exe picker, clipboard copy
• Smoke: grant trust, relaunch, confirm existing WorkspaceReviewToken still matches
• Compare Release MSIX size before/after if convenient

Made with Cursor

---

Summary by cubic

Dropped WinForms and replaced dialogs/clipboard with trim‑safe Win32/COM interop so Release MSIX can trim without changing workspace trust digest bytes. Added a shared STA dialog runner with safe exception-to-null handling and documented unmanaged call sites.

• Refactors

  • Centralized ShellFileDialog, Win32Clipboard, StaDialogCloser, StaModalDialogRunner, and NativeForegroundWindow in Core (source‑generated COM + LibraryImport) and replaced all WinForms dialogs/clipboard in both hosts.
  • Hardened dialogs/clipboard: keep COMDLG filter memory alive through Show via a using scope; close timed‑out pickers via the STA thread’s dialog HWND; publish native thread id via Volatile; capture owner before starting STA; bound CF_UNICODETEXT by GlobalSize and truncate at first null; retry OpenClipboard; centralize STA exceptions to return null; added XML docstrings and inline CodeQL annotations.
  • Named DTOs for CmdPal choices and digest (FormChoiceJson, TaskTypeChoiceJson, WorkspaceDigestPayload) via QuickShellJsonContext/QuickShellDigestJsonContext; tests pin legacy digest bytes.

• Dependencies

  • Enabled trimming for Release MSIX (PublishTrimmed=true), rooted QuickShellExtension via ILLink.Descriptors.xml, and treat trim warnings as errors (suppressed IL2104). Added System.Drawing.Common@9.0.8; continue using System.Text.Json@9.0.8 with source‑gen contexts.
  • Added CodeQL config and workflow wiring; exclude quality‑only cs/call-to-unmanaged-code and cs/unmanaged-code. Fixed release workflow links to master.