fix(download): guard entrypoint rejections; refresh architecture docs

[Arthurvdv]

Summary

Code review of the active ALCopsDownloadAnalyzers task wrapper, shared/ helpers, and build/packaging config. Deprecated tasks (install-analyzers, detect-tfm-*) and @alcops/core were out of scope.

Changes

• Bug — entrypoint error handling (tasks/download/src/index.ts): run() was called without a .catch(). Today the task-runner wraps everything in try/catch, but any future throw outside it would exit 0 and ADO would mark the task succeeded despite failure. Added the same .catch(... process.exit(1)) guard the other tasks already use.
• Doc — masking limitation (shared/log-inputs.ts): noted that logTaskInputs masks only secureString-typed inputs, so future secret inputs must be declared with a sensitive type to be redacted.
• Doc — architecture drift (.github/copilot-instructions.md): the file described an obsolete layout (referencing shared/http-client.ts, shared/nuget-registration.ts, tasks/install-analyzers/src/nuget-api.ts, a scripts/ dir, vi.mock('https') — none of which exist). Rewrote to reflect that all logic now lives in @alcops/core and shared/ holds only logger.ts + log-inputs.ts.

Considered and intentionally dropped

• @alcops/core version pin: ^0.1.2 matches npm latest (0.1.2). No drift — 0.2.0 is unreleased local source.
• Wrapper-side input validation: rejected to avoid duplicating the valid-TFM/detectFrom lists across task.json, the wrapper, and @alcops/core. Core is the single source of truth and already validates.

Verification

• npm run lint — clean
• npm run build (tsc) — clean
• npm test — 46/46 pass
• npm run bundle — succeeds; .catch guard confirmed present in tasks/download/dist/index.js