Unify hosted NuGet routing and XML splice anchors - #597

Final-head CI is complete: 482 successful checks, 6 skipped; no failures or pending checks. Bugbot passed, there are no unresolved review threads, and the PR is mergeable.

Hosted NuGet rewrites previously interpreted nuget.config with private regexes while restore and VEX used the shared XML reader. Commented-out sources could suppress the nuget.org fallback, and inert sections could receive the inserted Socket source or mapping. The CLI could then report a redirect that NuGet could not consume.

Fixes #561 and #585 by using the existing bounded NuGet XML reader for routing data and live insertion spans. This completes the hosted portion of #594 discussed in architecture discussion #560.

The shared model identifies comments, CDATA, processing instructions, quoted attributes, directly scoped sections, and insertion points after the last direct <clear> child. One insertion helper handles normal and self-closing sections. Malformed or ambiguous layouts refuse the redirect before any config edit, redirect claim, or lock re-pin.

Source names retain their XML identity when copied into fallback mappings. The reader normalizes literal CRLF and attribute whitespace before decoding character references; the writer escapes decoded tab, newline, and carriage return as numeric references. Thus corp	feed remains a tab-bearing name, while a literal attribute tab remains a space as NuGet interprets it. Original source markup stays byte-for-byte intact.

Validation:

• All 193 focused NuGet core tests passed after the review correction.
• The new eight-form whitespace regression fails on the original PR head and passes with the fix. It covers numeric references, literal tab/LF/CR/CRLF, and mixed literal/reference input.
• Eight real offline restores passed using .NET SDK 8.0.129 and a local NuGet feed. The original PR head reproduces NU1100 for an unrelated package after the fallback mapping changes its source identity; the base and fixed helper preserve it.
• An independent review checked 18 XML identity cases and separate NuGet controls, including character-reference boundaries and reference-looking text.
• Parser formatting and diff whitespace checks passed. The fixed commit merges cleanly with current main.
• Full CI, compatibility workflows, benchmarks, and Bugbot completed successfully on the corrected commit 8fa9750c.