Fix SonarCloud issues and unblock the build

[matt-edmondson]

Fixes all 90 open SonarCloud issues on ktsu-dev_Containers — 57 by code change, 33 by excluding the benchmark harness from analysis — and unblocks the build along the way.

Build fixes (were failing dotnet build)

main does not currently build locally against the pinned ktsu.Sdk 2.26.1, which added two analyzers:

• KTSU0007 — Polyfill now sets PrivateAssets="all" so this build-time-only package stops leaking into every consumer's dependency graph.
• KTSU0002 — added Containers/AssemblyInfo.cs exposing internals to ktsu.Containers.Test.

SonarCloud fixes — 57 of 90 open issues

Tests — 46

Rule	Count	Change
MSTEST0068	34	CollectionAssert.AreEqual → Assert.AreSequenceEqual
MSTEST0037	11	Assert.AreEqual(n, x.Length) → Assert.HasCount(n, x); Assert.IsTrue(a >= b) → Assert.IsGreaterThanOrEqualTo(b, a)
MSTEST0049	1	pass TestContext.CancellationToken to the Task.Run calls in ConcurrentProducerConsumer_TransfersAllItemsInOrder

Assert.AreSequenceEqual takes IEnumerable<T>, so the accompanying .ToArray() calls became redundant and tripped IDE0305 (warnings-as-errors) — they were dropped.

Library — 9

S1939 (8) — remove interfaces already implied by another entry in the base list.

ContiguousCollection, InsertionOrderCollection, OrderedCollection drop IReadOnlyCollection<T> (implied by IReadOnlyList<T>); RingBuffer drops both IEnumerable<T> and IReadOnlyCollection<T>.

⚠️ The three Set types needed care. Sonar reports IReadOnlySet<T> implies IReadOnlyCollection<T> — true, but IReadOnlySet<T> only exists under NET5_0_OR_GREATER, and this library still targets netstandard2.0/netstandard2.1. Removing IReadOnlyCollection<T> outright would have dropped the interface from those targets — a breaking API change. It was moved into an #else branch instead:

public class OrderedSet<T> : ISet<T>
#if NET5_0_OR_GREATER
		, IReadOnlySet<T>
#else
		, IReadOnlyCollection<T>
#endif

S4136 (1) — ContiguousMap.Entry: moved Equals(Entry) next to Equals(object?).

Benchmarks — 2

• S4487 (HIGH) — removed the unread keyValuePairs field in OrderedMapBenchmarks and its [GlobalSetup] assignment.
• S1481 — discard the intentional indexer read in CacheUsagePatternRingBuffer rather than binding an unused local.

Benchmarks excluded from analysis — retires 33 findings

Containers.Benchmarks now sets <SonarQubeExclude>true</SonarQubeExclude>. The remaining 33 open issues were all benchmark-only and all artifacts of benchmark style rather than defects:

• S3267 (29) — "loops should be simplified using Where". Every one is inside a [Benchmark] method, and they come in paired comparisons (ContiguousSet_Contains vs HashSet_Contains vs SortedSet_Contains, …). The foreach + if + counter shape is what makes those comparisons fair; rewriting with LINQ injects delegate and iterator overhead into the measured region and invalidates the benchmark.
• S4158 (3) — "collection is known to be empty here". Two are the Contains calls in EmptyCollectionOperations(), a benchmark that exists precisely to measure operations on empty collections. The third is a foreach over a RingBuffer immediately after PushBack; Sonar's dataflow doesn't model the mutation.
• S2583 (1) — cache.Count > 10 && random.Next(5) == 0 reported as always false. It is plainly reachable once 11 items have been pushed.

Benchmark code is also never executed by the test suite, so it can only ever report 0% coverage and drag down the new-code coverage gate. It is not shipped in the package.

Coverage

The first CI run failed the quality gate on new_coverage (0% vs 80% required) from exactly two uncovered new lines. One was benchmark code, handled by the exclusion above. The other was a genuine gap: ContiguousMap<TKey,TValue>.Entry is a public struct with a full equality surface — Equals(Entry), Equals(object?), GetHashCode(), ==, != — and had no tests at all. Added four covering equal/unequal entries, comparison against null and an unrelated type, and the Key/Value properties.

Docs

Refreshed the stale CollectionAssert.AreEqual guidance in CLAUDE.md, which now contradicted MSTEST0068.

Verification

• dotnet build — clean, 0 errors / 0 warnings across all 8 TFMs
• dotnet test — 355/355 pass (351 baseline + 4 new)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud