Add unsafe context migration code fixes

[EgorBo]

Follow-up to #131002

This PR adds the remaining code fixers (along with #131245) that assist in migrating to the new unsafe-v2 rules (unsafe evolution). The goals are:

• Code fixers should be idempotent as migrations to the new rules could be incremental.
• Code fixers should rely on existing Roslyn diagnostics rather than independently rediscovering unsafe operations.

New code fixers added in this PR:

1. [fixer] AddUnsafeContextCodeFixProvider fixes CS9360, CS9361, CS9362, CS9363, and CS9376 by introducing an unsafe context around the compiler-reported operation.

   The fixer prefers an unsafe { /* ... */ } statement containing a // SAFETY: Audit comment. When a statement would change scope, lifetime, control flow, or otherwise be invalid, it uses an unsafe(/* SAFETY: Audit */ expression) expression instead.

   Local declarations are split when that preserves semantics. In particular, stackalloc-to-span declarations are rewritten with a scoped forward declaration:

   scoped Span<byte> buffer;
   unsafe
   {
       // SAFETY: Audit
       buffer = stackalloc byte[10];
   }

   The fixer also handles constructor initializers, using aliases, expression-bodied members, catch filters, async/iterator restrictions, directives, top-level statements, scoped refs, implicit conversions, and generated disposal/enumeration operations. It declines to offer a fix when no semantics-preserving automated transformation is available.

2. [fixer] SynchronizeUnsafeContractCodeFixProvider fixes Roslyn's unsafe-to-safe contract mismatch diagnostics CS9364, CS9365, and CS9366, along with partial modifier mismatches CS0764 and CS9390.

   By the time this fixer runs, removable caller-unsafe modifiers have already been handled, so surviving unsafe contracts are propagated through source base members, interface declarations, overrides, implementations, and partial declarations. A pure safe partial mismatch defaults to unsafe, since safe is not currently valid on the non-extern partial declaration.

   The fixer does not add a new diagnostic for the opposite direction when the compiler accepts a safe implementation of an unsafe contract.

3. The old (added long ago by Andy) RequiresUnsafeCodeFixProvider is removed. It only handled CS9362, could change caller contracts by marking parent members unsafe, and did not preserve scope and lifetime reliably.

Diagnostics IDs

Just for reference:

• CS9360 [Roslyn] - An unsafe operation may only be used in an unsafe context.
• CS9361 [Roslyn] - A stackalloc expression without an initializer inside [SkipLocalsInit] may only be used in an unsafe context.
• CS9362 [Roslyn] - A member marked unsafe must be used in an unsafe context.
• CS9363 [Roslyn] - A member with pointers in its signature must be used in an unsafe context.
• CS9376 [Roslyn] - An unsafe context is required when an unsafe constructor satisfies a new() constraint.
• CS9364 [Roslyn] - An unsafe member cannot override a safe member.
• CS9365 [Roslyn] - An unsafe member cannot implicitly implement a safe member.
• CS9366 [Roslyn] - An unsafe member cannot explicitly implement a safe member.
• CS0764 [Roslyn] - Both partial member declarations must be unsafe, or neither may be unsafe.
• CS9390 [Roslyn] - Both partial member declarations must be marked safe, or neither may be marked safe.

---

Once this and #131245 are in, we should be able to perform a migration.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke, @dotnet/illink
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR expands the ILLink Roslyn analyzer/code-fix test infrastructure with new (DEBUG-only) “unsafe-v2” migration code fixers: one that introduces a minimal unsafe context for compiler-reported unsafe usages, and another that propagates intentional unsafe contracts across partials/overrides/interface implementations. It also removes the prior RequiresUnsafeCodeFixProvider and its tests/resources.

Changes:

• Add AddUnsafeContextCodeFixProvider and a comprehensive test suite covering many syntax positions and compiler diagnostics.
• Add SynchronizeUnsafeContractCodeFixProvider, shared contract helpers, and tests for contract propagation scenarios.
• Remove the legacy RequiresUnsafeCodeFixProvider and its associated tests, replacing the user-facing resource strings accordingly.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/tools/illink/test/ILLink.RoslynAnalyzer.Tests/UnsafeMigrationTestHelpers.cs	Minor formatting update in shared test setup for unsafe-v2 scenarios.
src/tools/illink/test/ILLink.RoslynAnalyzer.Tests/SynchronizeUnsafeContractCodeFixTests.cs	Adds new tests validating unsafe contract propagation behavior.
src/tools/illink/test/ILLink.RoslynAnalyzer.Tests/RequiresUnsafeCodeFixTests.cs	Removes tests for the deprecated legacy fixer.
src/tools/illink/test/ILLink.RoslynAnalyzer.Tests/AddUnsafeContextCodeFixTests.cs	Adds new tests validating unsafe-context insertion across many code shapes.
src/tools/illink/src/ILLink.RoslynAnalyzer/UnsafeMigrationSyntaxHelpers.cs	Adds GetSafeModifier helper for safe→unsafe token replacement scenarios.
src/tools/illink/src/ILLink.RoslynAnalyzer/UnsafeContractHelpers.cs	Introduces shared symbol/syntax helpers for unsafe contract propagation logic.
src/tools/illink/src/ILLink.CodeFix/UnsafeModifierCodeFixHelpers.cs	Adds SetUnsafeModifierAsync, adjusts insertion ordering for partial, and exposes WithModifiers.
src/tools/illink/src/ILLink.CodeFix/SynchronizeUnsafeContractCodeFixProvider.cs	New code fix provider that computes a contract closure and applies unsafe propagation edits.
src/tools/illink/src/ILLink.CodeFix/Resources.resx	Replaces removed fixer title and adds titles for the new code fixers.
src/tools/illink/src/ILLink.CodeFix/RequiresUnsafeCodeFixProvider.cs	Removes the deprecated legacy fixer implementation.
src/tools/illink/src/ILLink.CodeFix/ILLink.CodeFixProvider.csproj	Links in the new shared UnsafeContractHelpers.cs for code fix usage.
src/tools/illink/src/ILLink.CodeFix/AddUnsafeContext.cs	New code fix provider implementing minimal unsafe statement/expression introduction logic.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.