Add ClickOnce manifest foundation

[dtivel]

Part of #1049.

Summary

Add the dormant manifest foundation required by the ClickOnce signing algorithm version 2 specification.

• Add typed application and deployment manifest abstractions, adapters, and readers.
• Extract shared manifest behavior into ClickOnceManifestAdapter.
• Use IReadOnlyList for resolution inputs and FileInfo for serialization destinations.
• Fix metadata updates and serialization to use ManifestUtilities' v4.5 behavior, preserving SHA-256 digest values and declarations.
• Always preserve the source manifest XML so elements and attributes not modeled by ManifestUtilities survive serialization.
• Remove stale publisherIdentity and XML signature elements from the preserved XML before rewriting so regenerated signing metadata remains authoritative.
• Read preserved XML with DTD processing prohibited and no XML resolver.
• Redistribute the required MSBuild manifest runtime assemblies.
• Verify that those assemblies are included in the Sign CLI package.
• Add coverage for typed reads, manifest rejection, stream reuse, adapter contracts, metadata updates, application/deployment serialization, repeated writes, and preservation of unmodeled VSTO XML.

The preservation behavior is format-neutral. This PR does not classify manifests as ClickOnce or VSTO and adds no technology-specific API.

Behavior

The new implementation is dormant:

• It is not registered with dependency injection.
• It is not reachable from production signing.
• It adds no CLI options or dispatch changes.
• Existing ClickOnce version 1 behavior remains unchanged.

Testing

• Focused ClickOnce manifest tests: 33 passed, 0 failed
• Coverage verifies exact SHA-256 digest values and serialized SHA-256 DigestMethod declarations.
• Preservation coverage verifies that unmodeled XML survives rewriting while stale publisher and signature metadata does not.

[Copilot]

Pull request overview

Adds dormant typed ClickOnce manifest infrastructure for signing algorithm version 2.

Changes:

• Adds typed readers, interfaces, and shared manifest adapters.
• Enforces SHA-256 metadata updates and serialization via v4.5.
• Packages required MSBuild runtime assemblies and adds comprehensive tests.

Show a summary per file

File	Description
Directory.Packages.props	Pins compatible MSBuild manifest utilities.
src/Sign.Core/Sign.Core.csproj	Adds the manifest utilities dependency.
ApplicationManifestAdapter.cs	Adapts application manifests.
ClickOnceManifestAdapter.cs	Implements shared manifest operations.
ClickOnceManifestReader.cs	Reads typed ClickOnce manifests.
DeployManifestAdapter.cs	Adapts deployment manifests.
IApplicationManifest.cs	Defines the application-manifest contract.
IClickOnceManifest.cs	Defines common manifest operations.
IClickOnceManifestReader.cs	Defines typed reader operations.
IDeployManifest.cs	Defines the deployment-manifest contract.
scripts/VerifyNuGetPackage.ps1	Verifies packaged MSBuild assemblies.
ClickOnceManifestReaderTests.cs	Covers reading, adapters, hashing, and serialization.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 12/12 changed files
• Comments generated: 0
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 13/13 changed files
• Comments generated: 0 new
• Review effort level: Balanced