build: scoped OTOPCUA0001 NoWarn in 13 test projects, error under src/, pin SDK via global.json (#595 #606)

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

Directory.Build.props

@@ -2,12 +2,10 @@
   <!--
     Defaults inherited by every csproj. Individual projects may override.
 
-    Deviation from the original v2 plan: TreatWarningsAsErrors is NOT set globally because the
-    pre-v2 test projects (e.g. Admin.Tests) carry 240+ xUnit1051 analyzer warnings that would
-    fail the build. New v2 projects (Commons, Cluster, ControlPlane, Runtime, OpcUaServer, AdminUI,
-    Host, Security) MUST opt in to <TreatWarningsAsErrors>true</TreatWarningsAsErrors> in their
-    own csproj. Once the legacy Admin/Server projects are deleted (Phase 10, Task 56), this can
-    be promoted back to a global default.
+    TreatWarningsAsErrors is NOT set globally because test projects carry analyzer warnings
+    (e.g. xUnit1051) that would fail the build. src/ projects opt in to
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors> in their own csproj (a few still pending;
+    see #606). Once every project is clean this can be promoted back to a global default.
   -->
   <PropertyGroup>
     <TargetFramework>net10.0</TargetFramework>
@@ -16,6 +14,20 @@
     <LangVersion>latest</LangVersion>
   </PropertyGroup>
 
+  <!--
+    OTOPCUA0001 is an ERROR under src/ (#595): production code must route capability calls through
+    CapabilityInvoker. src/ is currently clean; test projects keep it a Warning and suppress it
+    per-csproj where they call drivers at the wire level. The path test is relative to this file
+    so it does not depend on where the repo is checked out; backslashes normalised for Windows.
+  -->
+  <PropertyGroup>
+    <_OtRepoRoot>$([System.String]::Copy('$(MSBuildThisFileDirectory)').Replace('\','/'))</_OtRepoRoot>
+    <_OtProjPath>$([System.String]::Copy('$(MSBuildProjectFullPath)').Replace('\','/'))</_OtProjPath>
+  </PropertyGroup>
+  <PropertyGroup Condition="$(_OtProjPath.StartsWith('$(_OtRepoRoot)src/'))">
+    <WarningsAsErrors>$(WarningsAsErrors);OTOPCUA0001</WarningsAsErrors>
+  </PropertyGroup>
+
   <!--
     Wire the custom OTOPCUA0001 analyzer (UnwrappedCapabilityCallAnalyzer) into every project so
     the CapabilityInvoker-wrapping rule is enforced tree-wide, not just against the analyzer's own