Bring the Publisher Concurrency and Aggregator Name to the Workflow Contract - #579

## Summary

Resyncs the carried instruction set with hub `ptr727/ProjectTemplate` at
`c175d557`, step 1 of the hub's `RESYNC.md`.

- `AGENTS.md`, `GOVERNANCE.md`: every verbatim section re-vendored with
`scripts/carry.py apply-sections`, inserting the two newly declared
sections, "Design Before Code" and "Trust Boundaries and Hardening
Effort". The repository's own preamble, "Devcontainer", and "Repository
Layout" text is untouched.
- `WORKFLOW.md`: the hub canonical. The old copy matched a past hub
revision exactly and carried nothing of its own.
- `CODESTYLE.md`: the hub canonical, keeping this repository's
"Utilities .NET Conventions" section. The hub's pointers to its hub-only
"Running the Linters Locally" section are re-pointed at `OPERATIONS.md`:
linter invocations and shell checks at "Local Verification", the commit
hook's scope at "Tool Usage", and its install step at "Runbooks".
- `OPERATIONS.md`: the documented prose gate now runs through `uv run
--no-project --script`. It declares PEP 723 dependencies, so the bare
`python3` form failed on a host without them.

`CLAUDE.md` already matched the hub. Findings closed, from `audit run
2026-11-09T16:22:11Z | hub c175d557`: every `verbatim: AGENTS.md` and
`verbatim: GOVERNANCE.md` finding, and the `intent` advisories on
`AGENTS.md`, `GOVERNANCE.md`, `CODESTYLE.md`, and `WORKFLOW.md`.

## Merge order

Merge this first. #578, #579, and #580 each depend on text it carries.

## Verification

- markdownlint, editorconfig-checker, and the pinned prose gate pass on
the changed files. The documented `OPERATIONS.md` prose gate command
runs clean against this branch.
- Local strict review ran three passes. The first two found the
commit-gate pointer and the bare `python3` command, both fixed here. The
final pass over the full diff found nothing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

## Summary

Promotes the hub resync to `main`. It carries four feature pull
requests, all merged into `develop` and resynced against hub
`ptr727/ProjectTemplate` at `c175d557`:

- #581 resyncs the instruction set: `AGENTS.md` and `GOVERNANCE.md`
verbatim sections, `WORKFLOW.md`, and `CODESTYLE.md` with the
repository's own .NET conventions kept. It also fixes the
`OPERATIONS.md` prose gate command, which now runs through `uv`.
- #578 re-vendors `.github/skills` and `.markdownlint-cli2.jsonc`. It
adds `decision-triage` and prunes `unattended-handoff`.
- #579 brings the publisher concurrency group onto D7.1 and gives the
required aggregator its ruleset-bound name only on a `pull_request` run
(D1.5).
- #580 reconciles the intent-fidelity files: `AUDIT.md`,
`.github/copilot-instructions.md`, `.editorconfig`, `.gitattributes`,
and `cspell.json`.

No shipped input changes, so this promotion publishes no package. Two
independent reasons:

- `git diff --name-only origin/main origin/develop` names none of the
publisher's push paths (`Utilities/**`, `version.json`,
`Directory.Build.props`, `Directory.Packages.props`).
`Directory.Packages.props` appears in this pull request's three-dot file
list only because `develop` (#576) and `main` (#577) took the same
Dependabot bump independently, so the trees already match. A push event
evaluates its path filter on the two-dot diff between the pushed
`before` and `after` commits.
- The pinned `publish-plan-task.yml` publishes a push to `main` only
when the actor is `ptr727-codegen[bot]` or `dependabot[bot]`. A
maintainer merging this promotion publishes nothing on any path.

## Audit

`audit run 2026-11-09T16:56:11Z | hub c175d557 | branch override
develop` reports 0 defect findings on `develop`, against the many
verbatim, tree, interface, and concurrency findings on `main` before the
resync. What remains is advisory:

- `.editorconfig-checker.json` and `version.json` are date-only intent
advisories. Their differences from the hub are this repository's own:
the `.artifacts/` exclusion and the 4.1 version floor.
- `.coderabbit.yaml`, `.pr_agent.toml`, and `.github/agent-policy.json`
are flagged hub-only. They are rendered reviewer configs every
repository carries, which ptr727/ProjectTemplate#3914 tracks declaring.
- A branch note says both workflow files changed on `main` (Dependabot
action bumps) and on `develop` since the merge base. A test merge of
`develop` into `main` auto-merges cleanly, and its tree equals
`develop`'s tree.

## Review coverage

#579 and #580 met every Merge Gate item. #581 and #578 merged into
`develop` with the maintainer's explicit authorization over item 2.
Their Lite Copilot rounds left files out of their file tables, which
sets the attested local pass aside (ptr727/ProjectTemplate#3955). Each
carried an attested local strict-review pass over every changed file.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Updated
[dotnet-outdated-tool](https://github.com/dotnet-outdated/dotnet-outdated)
from 4.8.1 to 4.9.0.

<details>
<summary>Release notes</summary>

_Sourced from [dotnet-outdated-tool's
releases](https://github.com/dotnet-outdated/dotnet-outdated/releases)._

## 4.9.0

## What's Changed
* Adopt MCP 2026-07-28 spec with legacy version negotiation by @​slang25
in dotnet-outdated/dotnet-outdated#772
* Fix concurrent cache corruption during recursive file-based app
upgrades by @​DamianEdwards in
dotnet-outdated/dotnet-outdated#788
* Fix: Parameter --maximum-version ignores exact version references by
@​chefarbeiter in
dotnet-outdated/dotnet-outdated#671
* Show a friendly message instead of crashing when a solution has no
projects by @​DanielC000 in
dotnet-outdated/dotnet-outdated#771
* Surface package-upgrade stdout so failures are diagnosable by
@​timabell in
dotnet-outdated/dotnet-outdated#790
* Fix multiline central package version updates by @​onuracar-dev in
dotnet-outdated/dotnet-outdated#783
* Support versioned MSBuild project SDKs in project files by @​thomhurst
in dotnet-outdated/dotnet-outdated#793
* Preserve whitespace in Directory.Packages.props during upgrades by
@​symbiogenesis in
dotnet-outdated/dotnet-outdated#803
* Treat package references injected by custom SDKs as auto-referenced by
@​thomhurst in
dotnet-outdated/dotnet-outdated#795
* Preserve version ranges when upgrading packages by @​GREsau in
dotnet-outdated/dotnet-outdated#702
* Preserve MSBuild version variables across project and props files by
@​symbiogenesis in
dotnet-outdated/dotnet-outdated#805
* Replace McMaster command-line parsing with System.CommandLine by
@​slang25 in dotnet-outdated/dotnet-outdated#808
* Bump version to 4.9.0 by @​slang25 in
dotnet-outdated/dotnet-outdated#806

## New Contributors
* @​chefarbeiter made their first contribution in
dotnet-outdated/dotnet-outdated#671
* @​DanielC000 made their first contribution in
dotnet-outdated/dotnet-outdated#771
* @​timabell made their first contribution in
dotnet-outdated/dotnet-outdated#790
* @​onuracar-dev made their first contribution in
dotnet-outdated/dotnet-outdated#783
* @​thomhurst made their first contribution in
dotnet-outdated/dotnet-outdated#793
* @​GREsau made their first contribution in
dotnet-outdated/dotnet-outdated#702

**Full Changelog**:
dotnet-outdated/dotnet-outdated@v4.8.1...v4.9.0


Commits viewable in [compare
view](dotnet-outdated/dotnet-outdated@v4.8.1...v4.9.0).
</details>

Updated [ptr727.Utilities](https://github.com/ptr727/Utilities) from
4.1.105 to 4.1.109.

<details>
<summary>Release notes</summary>

_Sourced from [ptr727.Utilities's
releases](https://github.com/ptr727/Utilities/releases)._

## 4.1.109

## What's Changed
* Bump the actions-deps group with 4 updates by @​dependabot[bot] in
ptr727/Utilities#574
* Bump the nuget-deps group with 2 updates by @​dependabot[bot] in
ptr727/Utilities#576
* Resync the Instruction Set With the Hub by @​ptr727 in
ptr727/Utilities#581
* Resync the Skills Tree and Markdownlint Config With the Hub by
@​ptr727 in ptr727/Utilities#578
* Bring the Publisher Concurrency and Aggregator Name to the Workflow
Contract by @​ptr727 in ptr727/Utilities#579
* Reconcile the Intent-Fidelity Carried Files With the Hub by @​ptr727
in ptr727/Utilities#580
* Promote the Hub Resync to Main by @​ptr727 in
ptr727/Utilities#582


**Full Changelog**:
ptr727/Utilities@4.1.108...4.1.109

## 4.1.108

## What's Changed
* Bump the actions-deps group with 4 updates by @​dependabot[bot] in
ptr727/Utilities#575
* Bump the nuget-deps group with 2 updates by @​dependabot[bot] in
ptr727/Utilities#577


**Full Changelog**:
ptr727/Utilities@4.1.105...4.1.108

Commits viewable in [compare
view](ptr727/Utilities@4.1.105...4.1.109).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>