- Analyzer.getGitHead: decode `git rev-parse HEAD` bytes as UTF-8
  instead of platform default (DM_DEFAULT_ENCODING).
- IndexCommand.call: narrow the cache-delete catch from blanket
  `Exception ignored` to `IOException` with a debug log line so
  silent data-loss is traceable (DE_MIGHT_IGNORE).
- PluginsCommand.categoryDescription: remove dead `Set<String>
  frameworks` local that was assigned and never read
  (DLS_DEAD_LOCAL_STORE).
- AntlrParserFactory.parse: replace identity-compare (`==`) of cache
  key with `.equals()`; cache behavior is unchanged because the
  parse tree is a deterministic function of content, so equal
  content yields an equivalent tree (ES_COMPARING_PARAMETER_STRING_WITH_EQ).

Verified `mvn compile` clean on phase-a/fixups-spotbugs.

- AnalysisCache.removeFile: guarantee rwLock.writeLock().unlock() on all
  exception paths by wrapping the finally's conn.setAutoCommit(true) in its
  own try-finally. Previously, a non-SQLException thrown by setAutoCommit
  (RuntimeException/Error) would escape the finally block before unlock ran,
  leaking the write lock. (UL_UNRELEASED_LOCK_EXCEPTION_PATH)

  Note: the same setAutoCommit-in-finally-then-unlock pattern appears in two
  other methods in this class; SpotBugs only flagged removeFile, but they
  likely share the same risk. Out of scope for this PR; file a follow-up.

- CodeIqApplication.main: collapse three identical else-if branches (isIndex /
  isEnrich / default) into one else with a combined rationale comment.
  (DB_DUPLICATE_BRANCHES)

- BundleCommand: remove unused private 4-arg writeEntry(zos, name, content,
  lineEnding) that delegated to the 3-arg overload and silently discarded
  lineEnding. (UPM_UNCALLED_PRIVATE_METHOD)

- PluginsCommand.SuggestSubcommand: iterate languageCounts.entrySet() instead
  of keySet() + get(). (WMI_WRONG_MAP_ITERATOR)

- GitLabCiDetector.detect: iterate data.entrySet() instead of keySet() + get().
  (WMI_WRONG_MAP_ITERATOR)

- CSharpPreprocessorParserBase: replace reference-compare (== / !=) on
  expression values with Objects.equals(). The compared values are String
  literals 'true'/'false' produced by sibling methods, so logical equality is
  the intended semantic; using == only worked coincidentally via string
  interning. (ES_COMPARING_STRINGS_WITH_EQ x2)

- VersionCommand.resolveVersion: narrow the outer catch from Exception to
  IOException since that is the only checked exception props.load can throw.
  Updated comment to document that the branch is an intentional fallthrough
  to the manifest-based lookup. (REC_CATCH_EXCEPTION)

Verified mvn compile clean.

…cord triage result

Added narrow exclude rules (class + pattern pair, not global) for:
- RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE in CSharpParserBase and
  GoParserBase — hand-written ANTLR parser support classes carried over
  from antlr/grammars-v4. Defensive null checks are harmless; touching
  them risks divergence if we re-sync upstream.
- BX_UNBOXING_IMMEDIATELY_REBOXED in CSharpPreprocessorParserBase —
  same origin, micro-perf, not correctness.

Updated BASELINE.md to mark the SpotBugs gap as RESOLVED with final
counts (1,492 -> 38; priority-1: 8 -> 0) and a pointer to the
post-triage summary JSON.

…sisCache methods

Follow-up to 798bccf. That commit fixed UL_UNRELEASED_LOCK_EXCEPTION_PATH
in AnalysisCache.removeFile and flagged the same lock-leak pattern in
two other methods that SpotBugs did not surface (likely because they
differ subtly in what's inside the outer try body).

Both methods — storeResults (the INSERT nodes/edges path) and the
replace-with-enriched-data path — had:

    } finally {
        try { conn.setAutoCommit(true); } catch (SQLException ignored) {}
        rwLock.writeLock().unlock();
    }

If conn.setAutoCommit(true) throws anything other than SQLException
(RuntimeException or Error), execution exits the finally before
rwLock.writeLock().unlock() runs, leaving the write lock held and
freezing all subsequent cache writers.

Wrap setAutoCommit in a nested try-finally so unlock is always reached:

    } finally {
        try {
            try { conn.setAutoCommit(true); } catch (SQLException ignored) {}
        } finally {
            rwLock.writeLock().unlock();
        }
    }

All three lock-holding paths (removeFile, storeResults, replace-with-
enriched) now share the same exception-safe pattern. mvn test -Dtest=
AnalysisCacheTest passes.