fix(security): bump System.Security.Cryptography.Xml to 8.0.4 (5 HIGH advisories) - #24

With the NU1903 restore block lifted, CI reaches the test step on macOS for
the first time since 2026-06-04 -- and 63 tests fail there with:

  System.PlatformNotSupportedException :
    System.Security.Cryptography.MLKem is not available on this platform.

macOS has no .NET 10 ML-KEM backend, so any test performing a real
encapsulation cannot run there. This is pre-existing and unrelated to the
System.Security.Cryptography.Xml bump; restore simply never got far enough
to reveal it. Windows passes the full suite.

Adds PqcFactAttribute / PqcTheoryAttribute, which set Skip when
MLKem.IsSupported is false, and applies them to exactly the 56 affected test
methods across 18 classes. The remaining 43 tests still run on macOS, so
platform coverage of the non-crypto paths is preserved.

This mirrors the PqcFactAttribute already used in postquantum-aspnetcore:
a test that cannot run its crypto skips with a reason, never silently passes.
The Linux and Windows legs continue to execute the full suite, so a real
regression cannot hide behind these skips.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The gate matched the older one-line VSTest summary ("Passed!  - Failed: 0,
Skipped: 0, ..."), but this SDK prints an indented per-project form:

      Passed: 108

and omits the Skipped line entirely when nothing skipped. Both lanes therefore
failed with "Could not locate a dotnet test summary line" even though the run
was clean.

The substantive change in the previous commit is confirmed working -- the Linux
lane now reports:

  MLKem.IsSupported = True
  Passed: 108

against 45 passed / 56 skipped before it, so the conda OpenSSL 3.5+ makes the
ML-KEM suite actually execute on Linux.

Now sums Passed and Skipped across every summary line, handles both shapes, and
additionally fails when no passing tests are found at all -- an empty or crashed
run must not slip through a gate whose only job is to prove the suite ran.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

With set -euo pipefail, `skipped=$(grep -oE 'Skipped:...' ...)` aborts the step
when the log contains no "Skipped:" line -- which is exactly the clean case this
gate exists to confirm. grep exits 1, pipefail propagates it, set -e kills the
step, and nothing is printed, so both lanes failed with no diagnostic output
despite 108 passing tests and zero skips.

Guards both counts with `|| true`. The explicit passed==0 check still catches a
genuinely empty or crashed run, so the gate keeps its purpose.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>