test(isotp): dispose the channel and the receive CTS deterministically

[dborgards]

Clears the three open alerts on code scanning, all in IsoTpChannelIntegrationTests.cs and all the same class of test hygiene.

Alert	Rule	Line
#274	cs/dispose-not-called-on-throw	417
#275	cs/dispose-not-called-on-throw	418
#276	cs/local-not-disposed	798

#274 / #275 — the channel

Dispose missed if exception is thrown by call to method ReceiveAsync. The channel was created with a plain var and closed only by the two explicit Dispose() calls the test makes deliberately, one line below the ReceiveAsync() that could throw first.

It now carries a using as well. Since the behaviour under test is that Dispose is idempotent, a third call at scope exit is by definition a no-op — the test still proves exactly what it did before, and no longer leaks the channel for the rest of the run when an assertion fails.

#276 — the receive CTS

Disposable 'CancellationTokenSource' is created but not disposed. It was constructed inline purely to reach .Token, leaving the timer it holds to the finalizer. Now owned by the test.

Scope: only the three reported sites

The same inline-CTS spelling appears 10 more times in this file and roughly 65 times across the suite, and CodeQL flagged exactly one of them. I did not sweep the rest:

• it would be a large mechanical diff in files two other pull requests are currently touching;
• each occurrence needs a uniquely named local in its scope, so it is not a safe blanket substitution;
• and in a short-lived xUnit test an undisposed CTS is a released-late timer, not a leak that outlives the process.

If you want the sweep, it should be its own pull request, and it is worth deciding at the same time whether a small test helper is better than 76 using var lines.

Verified

• dotnet test CanKit.Pro.sln -c Release → 412 passed, 0 failed
• dotnet build tests/CanKit.Pro.Tests -f net48 → 0 warnings, 0 errors
• No production code touched; the API approvals do not move.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Test-only disposal fixes for static analysis; no production or API changes.

Overview
Clears three CodeQL code-scanning alerts in IsoTp integration tests only; production ISO-TP behavior is unchanged.

In Dispose_Unblocks_Pending_ReceiveAsync, the channel is now using var so it is disposed on scope exit if ReceiveAsync or an assertion fails before the deliberate double Dispose() calls. The third dispose at exit is documented as a no-op given idempotency—the test still proves the same contract.

In Send_Faults_With_The_Bus_Layer_Exception_And_Channel_Remains_Usable, the receive timeout CancellationTokenSource is held in using var recvCts instead of an inline new, so its timer is released deterministically at test end (cs/local-not-disposed).

^{Reviewed by Cursor Bugbot for commit 6e0a8bd. Bugbot is set up for automated code reviews on this repo. Configure here.}