Upgrade Aspire and .NET dependencies

[ejsmith]

Summary

• upgrade Aspire SDK, hosting integrations, testing support, and CI CLI to 13.5.0
• align CI and container builds with .NET SDK 10.0.400 and ASP.NET Core runtime 10.0.11
• adopt the Aspire 13.5 run/publish app model and CLI bundle used by new AppHost templates

Aspire 13.5 migrations

• replace the obsolete PublishAsConnectionString customization with an explicit external Elasticsearch connection string in publish mode while retaining the local Elasticsearch container in run mode
• opt this existing AppHost into AspireUseCliBundle, matching the 13.5 templates and keeping orchestration dependencies supplied by the Aspire CLI
• model the JavaScript/Vite documentation and frontend resources as run-mode development servers; Exceptionless.Web.csproj remains the production owner that builds and copies both SPAs into the backend publish output
• preserve AppHost URL ordering through the compatibility helper until Aspire exposes the replacement property described by its obsoletion message

Official guidance:

• Aspire 13.5 breaking changes
• External parameters and AddConnectionString
• Aspire CLI bundle opt-in
• Deploy JavaScript apps

Impact

The development AppHost, CI tooling, and production container runtime use the latest stable Aspire and .NET servicing releases. The publish manifest now makes the existing Elasticsearch deployment requirement explicit. There are no application API or public configuration contract changes.

Aspire.Hosting.Browsers remains on the matching 13.5 preview build because that package is only published as a preview.

Validation

• post-rebase Release build: passed with 0 warnings and 0 errors
• full .NET test suite: 2,857 total, 2,854 passed, 3 skipped, 0 failed
• full Aspire publish: completed successfully and passed build-only resource validation; the unsupplied external Elasticsearch parameter produced the expected deployment-state warning
• full Aspire 13.5 runtime smoke: Api and App reached healthy state; /next/ and /api/v2/about returned HTTP 200
• NuGet vulnerability audit: no vulnerable direct or transitive packages reported
• .NET SDK/runtime container manifests verified for amd64, arm64, and armv7
• edited GitHub workflow YAML parsed successfully

Risk

Aspire 13.5.0 was published on August 18, 2026, so it is a very fresh release. Local build, test, publish, and runtime verification completed successfully.

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
Exceptionless.Insulation	37%	35%	286	❌
Exceptionless.Core	75%	67%	10184	✔
Exceptionless.Web	85%	69%	7903	✔
Exceptionless.AppHost	39%	40%	153	❌
Summary	78% (25162 / 32158)	67% (11807 / 17558)	18526	✔

[niemyjski]

Looks good, didn't test it but changes generally look good.