chore: retire QZP/SaaS machinery; lean quality gate + CodeQL alert sweep

src/CodexSessionManager.App/MainWindow.xaml.cs

@@ -50,7 +50,7 @@ public MainWindow()
         MaintenanceActionComboBox.ItemsSource = Enum.GetValues<MaintenanceAction>();
         MaintenanceActionComboBox.SelectedItem = MaintenanceAction.Archive;
         LocalDataRootProvider = () =>
-            Path.Combine(
+            Path.Join(
                 Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
                 "CodexSessionManager");
         RepositoryFactory = databasePath => new SessionCatalogRepository(databasePath);
@@ -80,11 +80,11 @@ private async Task InitializeAsync()
         {
             var localDataRoot = LocalDataRootProvider();
             Directory.CreateDirectory(localDataRoot);
-            await RunOnUiThreadAsync(() => DestinationRootTextBox.Text = Path.Combine(localDataRoot, "maintenance", "archive"));
+            await RunOnUiThreadAsync(() => DestinationRootTextBox.Text = Path.Join(localDataRoot, "maintenance", "archive"));
 
-            _repository = RepositoryFactory(Path.Combine(localDataRoot, "catalog.db"));
+            _repository = RepositoryFactory(Path.Join(localDataRoot, "catalog.db"));
             _workspaceIndexer = WorkspaceIndexerFactory(_repository);
-            _maintenanceExecutor = MaintenanceExecutorFactory(Path.Combine(localDataRoot, "checkpoints"));
+            _maintenanceExecutor = MaintenanceExecutorFactory(Path.Join(localDataRoot, "checkpoints"));
 
             await _repository.InitializeAsync(CancellationToken.None);
             await LoadSessionsFromCatalogAsync();
@@ -178,7 +178,7 @@ private Task<T> RunOnUiThreadValueAsync<T>(Func<T> func)
 
     private static List<KnownSessionStore> BuildKnownStores(bool deepScan)
     {
-        var codexHome = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".codex");
+        var codexHome = Path.Join(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".codex");
         var stores = new List<KnownSessionStore>(KnownStoreLocator.GetKnownStores(codexHome));
 
         if (!deepScan)
@@ -361,7 +361,7 @@ await RunOnUiThreadAsync(() =>
 
         if (string.IsNullOrWhiteSpace(destinationRoot))
         {
-            destinationRoot = Path.Combine(
+            destinationRoot = Path.Join(
                 Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
                 "CodexSessionManager",
                 "maintenance",
@@ -411,12 +411,12 @@ private async void ExecuteMaintenanceButton_OnClick(object _, RoutedEventArgs __
 
     private static string GetLiveSqliteStatus()
     {
-        var codexHome = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".codex");
+        var codexHome = Path.Join(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".codex");
         return GetLiveSqliteStatus(
             new[]
             {
-                Path.Combine(codexHome, "state_5.sqlite"),
-                Path.Combine(codexHome, "codex-sqlite", "canonical", "state_5.sqlite")
+                Path.Join(codexHome, "state_5.sqlite"),
+                Path.Join(codexHome, "codex-sqlite", "canonical", "state_5.sqlite")
             },
             path => DescribeSqlitePath(path, fileInfoFactory: null));
     }

src/CodexSessionManager.Storage/Discovery/KnownStoreLocator.cs

@@ -6,18 +6,23 @@ public static class KnownStoreLocator
 {
     public static IReadOnlyList<KnownSessionStore> GetKnownStores(string codexHome)
     {
+        // Preserve the previous fail-fast contract: Path.Combine threw on a null
+        // root, whereas Path.Join does not. Keep the explicit guard so behavior
+        // is unchanged after the Path.Combine -> Path.Join migration.
+        ArgumentNullException.ThrowIfNull(codexHome);
+
         return // nosemgrep: codacy.csharp.security.null-dereference -- false positive after constructor/guard validation.
         [
             new KnownSessionStore(
                 codexHome,
                 SessionStoreKind.Live,
-                Path.Combine(codexHome, "sessions"),
-                Path.Combine(codexHome, "session_index.jsonl")),
+                Path.Join(codexHome, "sessions"),
+                Path.Join(codexHome, "session_index.jsonl")),
             new KnownSessionStore(
                 codexHome,
                 SessionStoreKind.Backup,
-                Path.Combine(codexHome, "sessions_backup"),
-                Path.Combine(codexHome, "session_index.jsonl"))
+                Path.Join(codexHome, "sessions_backup"),
+                Path.Join(codexHome, "session_index.jsonl"))
         ];
     }
 }

src/CodexSessionManager.Storage/Discovery/SessionDiscoveryService.cs

@@ -26,10 +26,10 @@ private static KnownSessionStore CreateKnownSessionStore(SessionStoreRoot root)
 
         return root.StoreKind switch // nosemgrep: codacy.csharp.security.null-dereference -- false positive after constructor/guard validation.
         {
-            SessionStoreKind.Live => new KnownSessionStore(normalizedRoot, root.StoreKind, Path.Combine(normalizedRoot, "sessions"), Path.Combine(normalizedRoot, "session_index.jsonl")), // nosemgrep: codacy.csharp.security.null-dereference -- false positive after constructor/guard validation.
+            SessionStoreKind.Live => new KnownSessionStore(normalizedRoot, root.StoreKind, Path.Join(normalizedRoot, "sessions"), Path.Join(normalizedRoot, "session_index.jsonl")), // nosemgrep: codacy.csharp.security.null-dereference -- false positive after constructor/guard validation.
             SessionStoreKind.Backup when normalizedRoot.EndsWith(@"\sessions_backup", StringComparison.OrdinalIgnoreCase)
-                => new KnownSessionStore(normalizedBackupWorkspaceRoot, root.StoreKind, normalizedRoot, Path.Combine(normalizedBackupWorkspaceRoot, "session_index.jsonl")), // nosemgrep: codacy.csharp.security.null-dereference -- false positive after constructor/guard validation.
-            _ => new KnownSessionStore(normalizedRoot, root.StoreKind, normalizedRoot, Path.Combine(normalizedRoot, "session_index.jsonl")) // nosemgrep: codacy.csharp.security.null-dereference -- false positive after constructor/guard validation.
+                => new KnownSessionStore(normalizedBackupWorkspaceRoot, root.StoreKind, normalizedRoot, Path.Join(normalizedBackupWorkspaceRoot, "session_index.jsonl")), // nosemgrep: codacy.csharp.security.null-dereference -- false positive after constructor/guard validation.
+            _ => new KnownSessionStore(normalizedRoot, root.StoreKind, normalizedRoot, Path.Join(normalizedRoot, "session_index.jsonl")) // nosemgrep: codacy.csharp.security.null-dereference -- false positive after constructor/guard validation.
         };
     }
 }

src/CodexSessionManager.Storage/Discovery/SessionWorkspaceIndexer.cs

@@ -116,28 +116,32 @@ private static async Task<Dictionary<string, string>> LoadSessionIndexAsync(stri
         }
 
         var lines = await File.ReadAllLinesAsync(sessionIndexPath, cancellationToken); // nosemgrep: codacy.csharp.security.null-dereference -- false positive after constructor/guard validation.
-        foreach (var line in lines.Where(static value => !string.IsNullOrWhiteSpace(value)))
+        foreach (var document in lines
+            .Where(static value => !string.IsNullOrWhiteSpace(value))
+            .Select(static line => JsonDocument.Parse(line)))
         {
-            using var document = JsonDocument.Parse(line);
-            var root = document.RootElement;
-            if (!root.TryGetProperty("id", out var idElement) || idElement.ValueKind is not JsonValueKind.String)
+            using (document)
             {
-                continue;
-            }
+                var root = document.RootElement;
+                if (!root.TryGetProperty("id", out var idElement) || idElement.ValueKind is not JsonValueKind.String)
+                {
+                    continue;
+                }
 
-            var sessionId = idElement.GetString();
-            if (string.IsNullOrWhiteSpace(sessionId))
-            {
-                continue;
-            }
+                var sessionId = idElement.GetString();
+                if (string.IsNullOrWhiteSpace(sessionId))
+                {
+                    continue;
+                }
 
-            var threadName = root.TryGetProperty("thread_name", out var threadNameElement) && threadNameElement.ValueKind is JsonValueKind.String
-                ? threadNameElement.GetString()
-                : null;
+                var threadName = root.TryGetProperty("thread_name", out var threadNameElement) && threadNameElement.ValueKind is JsonValueKind.String
+                    ? threadNameElement.GetString()
+                    : null;
 
-            if (!string.IsNullOrWhiteSpace(threadName))
-            {
-                results[sessionId] = threadName!;
+                if (!string.IsNullOrWhiteSpace(threadName))
+                {
+                    results[sessionId] = threadName!;
+                }
             }
         }