build: declare CPM in Directory.Build.props for Scorecard detection

[Reefact]

Summary

Third and (source-backed) fix for OpenSSF Scorecard's Pinned-Dependencies check. Enabling Central Package Management in Directory.Packages.props (#94, #95) never moved the check off 7 — the v5.3.0 run kept reporting 0/2 nugetCommand dependencies pinned with only the base remediation text, i.e. its NuGet check evaluated CPM as disabled.

Root cause (internal/dotnet/properties/properties.go): the check reads every Directory.*.props file and keeps only the last one's config when deciding whether CPM is enabled (it overwrites its config per file). This repo also has Directory.Build.props, which has no ManagePackageVersionsCentrally element; read after Directory.Packages.props, it overwrites the "enabled" verdict with "disabled". (This also explains why the earlier comment-rewording had no effect — Scorecard uses xml.Unmarshal, which ignores comments.)

Fix: declare ManagePackageVersionsCentrally=true in Directory.Build.props too. It carries no <PackageVersion>, so the empty version set trivially satisfies Scorecard's "all versions are fixed" rule and the restore is credited as pinned.

Note: confirmation can only come from the next scorecard run on main (Scorecard isn't runnable locally here). Given the current run proves Directory.Build.props is the last-scanned props file, this is well-grounded — but it's the fix, not a guarantee.

Type of change

• Bug fix
• New feature
• Breaking change
• Refactoring
• Analyzer / diagnostic change
• Tests
• Documentation
• Build / CI / tooling

Changes

• Directory.Build.props: added a <PropertyGroup> with <ManagePackageVersionsCentrally>true</...> (redundant for MSBuild — same value as Directory.Packages.props — with a comment explaining the Scorecard tooling reason). FloorCheck still overrides it to false in its own project file.

Testing

• dotnet build FirstClassErrors.sln (Release, with the CI warning ratchet — 0 warnings)
• dotnet test FirstClassErrors.sln (Release — 598 passed, 0 failed)
• Analyzer tests pass (FirstClassErrors.Analyzers.UnitTests)

Documentation

• Public API / error documentation updated
• README / doc/ updated
• French translation (doc/README.fr.md) updated if user-facing behavior changed
• No documentation change required — MSBuild behaviour is unchanged; the property is redundant and self-documented in the file.

Related issues

None.

🤖 Generated with Claude Code

https://claude.ai/code/session_014W1zrcBNy3jEs8ngAQKwZg

---

Generated by Claude Code