Pin the pre-push hook's .NET channel and prefer an installed SDK

A git hook runs with a stripped PATH, so `command -v dotnet` missed the SDK
that was already installed and ensure_dotnet fell through to downloading one.
It asked for the current channel, got .NET 9, and failed every project in the
solution with NETSDK1045 — the build only breaks when the hook actually runs,
which is precisely when it is least welcome.

ensure_dotnet now looks in DOTNET_ROOT and the usual per-user and system install
locations before downloading anything, and the download is pinned to the channel
matching the repo's TargetFramework rather than whatever is current.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S56bfZMGe1hnhpWP4CjjNw

scripts/ci/lib.sh

@@ -15,20 +15,35 @@ fail() {
 # Repo root, regardless of the caller's cwd.
 CI_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 
-# Prepends a locally installed .NET SDK to PATH when `dotnet` is missing, so a runner
-# with no SDK preinstalled behaves the same as a dev machine.
+# The .NET channel to install when no SDK is found. This has to match the TargetFramework
+# the projects declare — a git hook runs with a stripped PATH, so "whatever channel is
+# current" quietly installed .NET 9 for a net10.0 repo and failed the whole build.
+DOTNET_CHANNEL="${DOTNET_CHANNEL:-10.0}"
+
+# Puts a .NET SDK on PATH. Prefers one that is already installed — including the common
+# per-user and system locations a git hook's PATH does not include — and only downloads
+# one as a last resort, so a bare runner behaves the same as a dev machine.
 ensure_dotnet() {
   if command -v dotnet > /dev/null 2>&1; then
     return 0
   fi
 
+  local candidate
+  for candidate in "${DOTNET_ROOT:-}" "$CI_ROOT/.dotnet" "$HOME/.dotnet" /usr/share/dotnet /usr/lib/dotnet; do
+    if [[ -n "$candidate" && -x "$candidate/dotnet" ]]; then
+      log "Using the .NET SDK at $candidate"
+      export PATH="$candidate:$PATH"
+      export DOTNET_ROOT="$candidate"
+      return 0
+    fi
+  done
+
   local install_dir="$CI_ROOT/.dotnet"
-  if [[ ! -x "$install_dir/dotnet" ]]; then
-    log "dotnet not found on PATH; installing the .NET SDK"
-    curl -fsSL https://dot.net/v1/dotnet-install.sh -o "/tmp/dotnet-install.sh"
-    bash "/tmp/dotnet-install.sh" --channel STS --install-dir "$install_dir"
-    rm -f "/tmp/dotnet-install.sh"
-  fi
+  log "dotnet not found; installing the .NET $DOTNET_CHANNEL SDK into $install_dir"
+  curl -fsSL https://dot.net/v1/dotnet-install.sh -o "/tmp/dotnet-install.sh"
+  bash "/tmp/dotnet-install.sh" --channel "$DOTNET_CHANNEL" --install-dir "$install_dir"
+  rm -f "/tmp/dotnet-install.sh"
+
   export PATH="$install_dir:$PATH"
   export DOTNET_ROOT="$install_dir"
 }