fix(coding-dev): scoped suppressions, contribution-dependent precedence

- suppressions: prefer the narrowest scope that covers the problem (line,
  function, module) with a reason comment; a project-wide disable silences
  the rule in code nobody has written yet. Always name the specific rule.
  Propagated to rust (#[allow]), csharp (#pragma/SuppressMessage).
- precedence: a project's own rules win only when contributing upstream.
  For local/private work these rules win, adopting only the project's
  load-bearing conventions.
- type checking must pass with zero errors *or warnings*.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

code-languages/csharp-dotnet.md

@@ -37,8 +37,11 @@ dotnet build MySolution.sln -warnaserror
 - **Nullable warnings are real bugs.** Never silence one with `!` (null-forgiving) — narrow
   the type or fix the contract. `!` is an assertion, and an assertion you cannot prove is a
   future `NullReferenceException`.
-- Never blanket-disable an analyzer. If a rule is genuinely wrong for the codebase, configure
-  it once in `.editorconfig` with a comment.
+- Never blanket-disable an analyzer. When a rule is genuinely wrong for a piece of code,
+  scope the suppression to it — `#pragma warning disable CA1822` around the smallest region
+  that needs it (with a matching `restore`), or a targeted `[SuppressMessage]` attribute —
+  and always with a `Justification` / comment saying why. An `.editorconfig` entry turns the
+  rule off for every file it covers; use it only when the rule is wrong codebase-wide.
 
 ---
 

code-languages/js-typescript.md

@@ -43,13 +43,14 @@ into a project that has neither.
 }
 ```
 
-**`tsc --noEmit` must pass with 0 errors**, and it belongs in the build gate alongside lint
-and tests — not as a thing someone runs occasionally in their editor.
+**`tsc --noEmit` must pass with zero errors *and* zero warnings**, and it belongs in the build
+gate alongside lint and tests — not as a thing someone runs occasionally in their editor.
 
 > [!NOTE]
 > Some established codebases deliberately relax `noImplicitAny` or `noUncheckedIndexedAccess`
-> because their idioms depend on it. Respect the project's `tsconfig.json`; the table above is
-> the default for **new** projects.
+> because their idioms depend on it. When **contributing upstream**, respect the project's
+> `tsconfig.json` as-is. In **our own repos and non-upstreamed forks**, the settings above are
+> the target — tightening them is fair game (as its own change, not smuggled into a feature).
 
 ---
 

code-languages/rust.md

@@ -61,8 +61,17 @@ workspace = true
 > carries a second copy that drifts — which is how a binary once kept reading its own stale
 > allows while the workspace's were being actively edited.
 
-- **Never `#[allow]` on a whim.** If a lint is genuinely wrong for the codebase, allow it
-  **workspace-wide** with a comment explaining why, so the decision is visible.
+- **Never `#[allow]` on a whim** — but when a lint is genuinely wrong for a piece of code,
+  **allow it at the narrowest scope that covers it** (the expression, the function, the
+  module) with a comment saying why:
+  ```rust
+  // The FFI callback signature is fixed by the C API; we cannot take fewer arguments.
+  #[allow(clippy::too_many_arguments)]
+  extern "C" fn on_event(/* … */) { }
+  ```
+- A **workspace-wide** allow in `[workspace.lints]` is for the rare case where the lint is
+  wrong for the *entire* codebase — not a shortcut for one stubborn call site. It silences
+  the rule in code nobody has written yet.
 - **Re-test every `#[allow]` periodically.** If removing one produces no warning, delete it.
 - `too_many_lines` is the mechanical enforcement of the 100-line function limit. A function
   that trips it wants extracting, not an allow.