Fix #4079: make stable Roslyn restorable from the solution directory

ICSharpCode.Decompiler.Generators pins a stable Microsoft.CodeAnalysis.CSharp
(a source generator must not reference a Roslyn newer than the host compiler)
and ILSpy.AddIn.VS2022 pins a stable 4.0.1. Stable Roslyn lives only on
nuget.org, but the repo-root NuGet.config mapped Microsoft.CodeAnalysis.*
exclusively to the dotnet-tools feed, which carries only prerelease builds.
Both projects worked around that with a per-project NuGet.config. dotnet
restore honors it, since settings are computed per project directory, but
Visual Studio starts NuGet.config discovery at the solution directory and
never sees it: the first restore in VS on a machine with a cold NuGet cache
fails with NU1103 exactly as reported. Once any successful restore has put
the stable package into the global packages folder, source mapping is
satisfied from the cache and the problem never reappears on that machine,
which is why #3835 was closed as unreproducible.

NuGet consults every source that declares the longest pattern matching a
package id, so mapping Microsoft.CodeAnalysis.* to nuget.org as well as to
dotnet-tools makes both feeds available for the whole family: the stable
versions resolve from nuget.org and the prerelease $(RoslynVersion) from
dotnet-tools. Both per-project configs are then redundant and removed.

Verified with an empty NUGET_PACKAGES and the root config forced as the only
config (simulating VS's discovery): the old config reproduces the reported
NU1103; with the new config the generator, the decompiler tests (prerelease
Roslyn) and the VS add-in (stable 4.0.1 with its Workspaces dependencies)
all restore; restore.ps1 over ILSpy.sln leaves the lock files unchanged.

Assisted-by: Claude:claude-fable-5:Claude Code

ICSharpCode.Decompiler.Generators/ICSharpCode.Decompiler.Generators.csproj

@@ -9,8 +9,8 @@
     <!-- Opt out of the repo's central package management for this project: a source generator must
          reference a Roslyn no newer than the running compiler, but the repo's $(RoslynVersion) tracks
          the (newer) preview SDK compiler. Pin to a stable lower version any supported host can load.
-         The stable package lives on nuget.org; the local NuGet.config reaches it past the repo-root
-         source mapping that otherwise routes Microsoft.CodeAnalysis.* to the dotnet-tools feed. -->
+         The stable package lives on nuget.org only; the repo-root NuGet.config maps
+         Microsoft.CodeAnalysis.* to nuget.org as well as to the dotnet-tools feed for that reason. -->
     <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
   </PropertyGroup>
 

ICSharpCode.Decompiler.Generators/NuGet.config

@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<configuration>
-  <!-- The repo-root NuGet.config maps Microsoft.CodeAnalysis.* exclusively to the dotnet-tools feed,
-       which carries only prerelease Roslyn builds. This source generator deliberately references a
-       stable Roslyn (see the csproj), which lives on nuget.org. Clearing the inherited sources and
-       mapping here lets this project restore that stable package; it has no other dependencies. -->
-  <packageSources>
-    <clear />
-    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
-  </packageSources>
-  <packageSourceMapping>
-    <clear />
-    <packageSource key="nuget.org">
-      <package pattern="*" />
-    </packageSource>
-  </packageSourceMapping>
-</configuration>

ILSpy.AddIn.VS2022/NuGet.config

@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<configuration>
-  <packageSources>
-    <clear />
-    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
-  </packageSources>
-  <packageSourceMapping>
-    <clear />
-    <packageSource key="nuget.org">
-      <package pattern="*" />
-    </packageSource>
-  </packageSourceMapping>  
-</configuration>

NuGet.config

@@ -13,6 +13,12 @@
       <package pattern="Microsoft.DiaSymReader.Native" />
       <package pattern="Microsoft.DiaSymReader" />
       <package pattern="Microsoft.CodeAnalysis.NetAnalyzers" />
+      <!-- Microsoft.CodeAnalysis.* is mapped to both this feed and dotnet-tools: NuGet consults every
+           source that declares the longest matching pattern, so stable Roslyn builds (nuget.org only;
+           the source generator and the VS add-in pin those) and prerelease builds (dotnet-tools only;
+           $(RoslynVersion)) both resolve from a config discovered at the solution directory, which is
+           all Visual Studio reads. -->
+      <package pattern="Microsoft.CodeAnalysis.*" />
     </packageSource>
     <packageSource key="dotnet10-transport">
       <package pattern="ILCompiler.Reflection.ReadyToRun.Experimental" />