chore: pin reproducible .NET toolchain

[IvanLarinDev]

Summary

• pin the repository to .NET SDK 10.0.302 and the latest secure 10.0.10 runtime patch on win-x64
• lock the complete NuGet graph, restrict sources, enable all-level audit, and fail closed on NU1900-NU1905
• align local helpers, documentation, CI, release workflow, and release orchestrator on explicit locked restore / --no-restore
• use the stable windows-2025 runner, add Dependabot maintenance, and verify framework-dependent plus self-contained runtime metadata
• add repository policy tests, including external --artifacts-path support and restore-closed documentation checks

Verification

• dotnet build Dropwheel.slnx --configuration Release --no-restore --nologo -warnaserror — 0 warnings, 0 errors
• unit tier — 476 passed
• Windows integration tier — 7 passed
• external-artifacts policy tier — 5 passed
• framework-dependent and self-contained runtime probe — Core/Desktop 10.0.10
• explicit win-x64 FD and SC publish — both produced Dropwheel.exe
• dotnet list ... --vulnerable --include-transitive --no-restore — no vulnerable packages
• unavailable audit source probe — restore failed closed with NU1900/NU1905
• run.cmd build, PowerShell AST, YAML parse, dotnet format --verify-no-changes, and git diff --check — passed
• independent fail-closed review of staged diff 728141bbb270bb83eb4f039de01441d8547ea686 — passed with no security concerns or logic errors