Update safe stable dependencies without unnecessarily raising consumer requirements

[carldebilly]

Goal

Audit the solution's direct and implicit dependencies against the latest stable releases, while avoiding version churn that unnecessarily raises the minimum transitive requirements imposed on applications consuming Repl packages.

This is best-effort for Repl 0.11. A non-mechanical update must not delay the release.

Dependency policy

• Use stable releases only: no previews, release candidates, nightly builds, or floating versions.
• Build, test, analyzer, and source-control tooling declared with PrivateAssets="all" can generally move to the latest stable release when the update remains mechanical and the full solution stays green.
• Runtime dependencies exposed transitively by a shipped Repl package must move only for a concrete compatibility requirement, bug fix, security fix, or feature that Repl needs—not merely because a newer version exists.
• Do not add direct references for packages supplied implicitly by MSTest.Sdk; update the SDK and let it select its matching TestAdapter, TestFramework, CodeCoverage, and TRX packages.
• Keep compatibility-only edits separate from unrelated refactoring.

Explicitly in scope

ModelContextProtocol 1.x

Update ModelContextProtocol from 1.2.0 to 1.4.1.

• Stay on the stable 1.x line for Repl 0.11.
• Do not adopt any 2.0 preview here.
• MCP SDK 2.0 migration and protocol-readiness work remains tracked by Ready for ModelContextProtocol v2.0 #51.
• Verify tools, resources, prompts, logging, structured/paged results, sampling, elicitation, roots, MCP Apps metadata, and long-running-command metadata under 1.4.1.

Private build/test/tooling candidates

Use the Rider stable-package report as the starting point:

• Meziantou.Analyzer: 3.0.44 → 3.0.122
• Microsoft.SourceLink.GitHub: 10.0.201 → 10.0.300
• Microsoft.VisualStudio.Threading.Analyzers: 17.14.15 → 18.7.23
• Nerdbank.GitVersioning: 3.9.50 → 3.10.91
• Microsoft.Extensions.TimeProvider.Testing: 10.4.0 → 10.7.0
• XTerm.NET: 1.0.12 → 1.0.15
• MSTest.Sdk: 4.1.0 → 4.3.2
  • Expected implicit graph includes MSTest TestAdapter/TestFramework 4.3.2, CodeCoverage 18.9.0, and TrxReport 2.3.2.

Each candidate can be held back if it introduces analyzer churn, build changes, or other work disproportionate to the benefit for 0.11.

Intentionally not updated without a separate reason

• Spectre.Console stays at 0.55.0. Updating Repl.Spectre would raise the minimum Spectre version required of consuming applications, and there is no identified Repl requirement for 0.57.x.
• Spectre.Console.Json stays at 0.54.0 unless a sample-specific compatibility need is demonstrated.
• Microsoft.Extensions.DependencyInjection, Hosting, and Logging stay at their current 10.0.5 lower bounds unless a concrete servicing/security fix is needed by Repl. These references are transitively visible from shipped packages.

Acceptance criteria

• All selected versions are stable releases.
• ModelContextProtocol is updated to 1.4.1, with 2.0 explicitly left to Ready for ModelContextProtocol v2.0 #51.
• No implicit MSTest packages are converted into unnecessary direct references.
• dotnet restore src/Repl.slnx succeeds.
• dotnet build src/Repl.slnx -c Release --no-restore succeeds with warnings treated as errors.
• The complete test suite passes under Microsoft.Testing.Platform.
• Documentation lint, real-shell completion smoke tests, samples, and package validation remain green.
• Generated package dependency metadata is compared before/after; no unintended consumer minimum is raised.
• Held-back dependencies and the reason for holding each one are recorded in the PR.
• Any update requiring non-trivial migration is split or deferred rather than delaying Repl 0.11.