CI: auto-regenerate dependent packages.lock.json on Dependabot NuGet PRs #203

Problem

Dependabot bumps a package in one project and regenerates only that project's packages.lock.json. Downstream projects (test projects referencing it via ProjectReference) pin the transitive graph in their own lock files, which go stale → dotnet restore --locked-mode fails with NU1004 in CI. Known upstream limitation: dependabot-core#5461.

2026-07-24 this broke all four open Dependabot PRs at once (#192, #194, #195, #196); each needed a manual dotnet restore --force-evaluate + commit. It will recur on every future src-project bump (e.g. the expected Microsoft.OpenApi 2.11.0 PR).

Proposed fix

Workflow triggered on Dependabot PRs (pull_request + actor == dependabot[bot], or workflow_run): checkout PR branch, dotnet restore Cluckwork.sln --force-evaluate, commit & push lock-file diff back to the PR branch if dirty. Needs contents: write + care with the Dependabot-PR token (secrets restrictions on dependabot-triggered events — likely needs pull_request_target with pinned checkout or a PAT/GitHub App token; harden accordingly, changed files are lock files only).

Done means

• Dependabot NuGet PR bumping a src project goes green without manual intervention
• Workflow cannot be abused to execute PR-author-controlled build code with elevated token (review restore-time MSBuild execution surface)

Epic: #15