Update UImGui to Dear ImGui 1.92.9

[psydack]

Summary

• bump UImGui to 7.2.0 and Dear ImGui / ImGui.NET to 1.92.9
• refresh all eight managed/native integrations and synchronize one native revision across Windows x64, x86 and ARM64, Linux x64, and macOS universal
• update the renderers for the current ImDrawData.CmdLists API
• harden Windows builds with static MSVC runtime linkage, ASLR, DEP, Control Flow Guard, reproducible linking, and PE 1.92.9.0 metadata
• update package metadata, README, CHANGELOG, dependency versions, maintenance instructions, and the reproducible sync-imgui.ps1 pipeline
• add PR package-integrity CI and a checked-in SHA-256 manifest for all 16 Windows x64/x86 DLLs

Why

This addresses the generic ESET detection reported in #91. The affected files are unsigned, low-prevalence native extension DLLs, and the audit found no suspicious imports or behavior. The rebuild/hardening is intended to reduce reputation-based false positives and make every artifact traceable to one source revision. The package is still unsigned because the project does not currently have an Authenticode code-signing certificate.

Verification

• native matrix: Windows x64/x86/ARM64, Linux x64, and macOS universal all passed
• native functional suite: 7/7 passed; required exports verified on every platform
• binding CI: passed from a clean runner
• clean .NET rebuild and NuGet pack: 0 errors, 0 warnings
• Unity 6000.5.2f1 EditMode suite: 19/19 passed (repeated after final package changes)
• Microsoft Defender scan of the final Plugins tree: no threats; the four VirusTotal/Microsoft-flagged files were also re-scanned individually with engine 1.1.26060.3008 and definitions 1.455.392.0, all clean
• all 16 Windows x64/x86 DLLs verified with ASLR, DEP, CFG, static CRT, and only standard Windows DLL imports
• UImGui package validation: package metadata, five-platform artifact matrix, Unity .meta sidecars, removed API usage, and all Windows SHA-256 checks passed
• fresh VirusTotal results: ESET-NOD32 18.2.18.0 / update 20260728 reported all seven files as undetected; residual minority results are generic ML/heuristic labels and are documented per file

The release candidate has completed the planned checks and is ready for review and merge. No release tag is created by this PR.

[psydack]

Final antivirus validation completed.

• Uploaded all seven x64 DLLs reported in 7.1.0 release triggers anti-virus #91 to VirusTotal and waited for fresh analyses.
• ESET-NOD32 18.2.18.0 / update 20260728: undetected on all seven.
• Three files: 0 malicious verdicts; cimnodes_r.dll: 1 generic verdict; the remaining three: 2 generic verdicts each.
• Residual labels are Microsoft Wacatac.B!ml, Ikarus Trojan.Win64.Krypt, and Elastic moderate-confidence ML.
• Re-scanned the four Microsoft-flagged files individually with local Defender engine 1.1.26060.3008, product 4.18.26060.3008, definitions 1.455.392.0: no threats on all four.
• Public reports and the complete per-file breakdown are recorded in issue #91.

Combined with the green native matrix, binding CI, package CI, 7/7 native tests, and 19/19 Unity tests, the release candidate meets the merge-readiness criteria.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d45d88fe6b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add ARM64 DLLs to checksum verification

The artifact-matrix step accepts eight win-arm64 DLLs, but WINDOWS_SHA256SUMS contains only the 16 x86/x64 binaries. GNU sha256sum --help defines --check as “read checksums from the FILEs and check them,” so this command succeeds even if any committed ARM64 DLL is replaced or corrupted. Include the ARM64 artifacts in the manifest, and preferably validate that every Windows native DLL has exactly one entry. KKUT.mdL9-L9

Useful? React with 👍 / 👎.

[dri-richard]

Just flagging that this file has no meta file so currently causes a (non-blocking) error in Unity. Not sure if the intention is to delete this file before merging the PR.