Mechanically enforce the .editorconfig scoped analyzer lists #434

Background

CLAUDE.md's zero-warnings ratchet escalates IDE0008 and IDE0090 to warning only for the files
a piece of work touches, via two hand-maintained path lists in .editorconfig. The lists are
maintained by memory, and CLAUDE.md already records that memory alone did not work once: the
boyscout rule was "silently missed across several consecutive #312 commits before the developer caught
it by eye."

It has now been found incomplete twice more:

• Reset returns an unhandled 500 when no backup can be taken, and the five backup failure causes are indistinguishable #348: 15 files were missing from the lists, hiding 22 IDE0090 warnings.
• A reset in the first moments after startup races the what's-new notification's write #419's follow-on work: 2 files (BackupFileNamesTests.cs, DatabaseBackupReaderTests.cs) were in
  the IDE0008 list but not the IDE0090 one, hiding 8 IDE0090 warnings under a build reporting
  0 Warning(s).

Both were found by eye, not by tooling. CLAUDE.md names this exact condition as the trigger for this
issue: "raise it as its own issue if the manual list starts being forgotten in practice." The second
occurrence is what makes it practice rather than an incident.

The failure mode is specifically invisible: a file missing from the list produces no warning, so the
0-warnings gate passes and reports nothing. There is no signal to notice.

What needs to be done

1. A test fails when a .cs file changed on the current branch, relative to the base branch, is
   absent from .editorconfig's scoped IDE0008 section.
2. The same check for the scoped IDE0090 section, or a recorded decision in the plan doc that
   IDE0090 is deliberately excluded and why. The two rules are worded differently in CLAUDE.md
   (IDE0008 says "the moment it is first touched", IDE0090 says "the moment it needs this
   cleanup"), and that difference has to be resolved before the check can be written, not during.
3. The exclusion set is explicit and stated in the test itself: which paths are out of scope and on
   what grounds, rather than an unexplained skip list.
4. The test behaves correctly when run on the base branch itself, where there is no diff to compare
   against, and in a detached or shallow checkout as CI may produce. A test that only works on a
   feature branch in a full clone replaces a forgotten list with an unreliable gate.

Expected tests

Definition of done

• All expected tests listed above start red before implementation
• All requirements implemented
• All expected tests pass (green)
• No regression in related tests
• Findings summarised in a closing comment