Complete Source Link config: add deterministic build, CI build, and explicit SourceRoot

### Summary

This repository already references `Microsoft.SourceLink.GitHub` and sets `PublishRepositoryUrl` / `EmbedUntrackedSources`, so basic Source Link works. However, it is missing several elements of the canonical Source Link + deterministic-build configuration now standardized across the AWS .NET libraries (see aws/integrations-on-dotnet-aspire-for-aws#245):

- **`true`** — explicit (not relying on the SDK default).
- **CI-gated ``** — currently absent, so CI builds are not path-normalized/fully reproducible and build-agent paths can leak into the PDB.
- **Explicit ``** — needed because the AWS release pipeline packs from a source archive **without a `.git` directory**; without it Source Link cannot derive the repository root and emits no commit-pinned document map.

### Requested change

Bring the build configuration up to the template. Prefer consolidating into a shared `Directory.Build.props` (and `Directory.Packages.props` if using central package management) rather than duplicating across each `.csproj`:

```xml

git
true
true
true
true

```

### Why

Reproducible builds and reliable commit-pinned Source Link for the shipped NuGet packages, consistent with the rest of the AWS .NET library set.

### References

- Canonical template: aws/integrations-on-dotnet-aspire-for-aws#245
- Pipeline build-script revision support: aws/aws-dotnet-devex-pipelines#197

Start by locating the existing project files and any shared Directory.Build.props or Directory.Packages.props, then compare their current Source Link and package configuration with the requested template. Check how CI exposes CI, TF_BUILD, or CODEBUILD_BUILD_ID and how SourceRevisionId is supplied. Done means deterministic and CI-gated builds, the SourceLink package settings, and guarded explicit SourceRoot are present without duplicating configuration across projects.

Written by the indexing model from the issue text.