Bump the nuget-deps group with 1 update - #595

## Summary

Promotes the hub resync to `main`. It carries four pull requests, all
merged into `develop`. The resync is against hub
`ptr727/ProjectTemplate` at `009d3e5e`:

- #597 resyncs the instruction set and the Skills tree. The `AGENTS.md`
and `GOVERNANCE.md` verbatim sections are re-vendored. The hub's
`CODESTYLE.md` and `.github/copilot-instructions.md` changes are merged
with this repository's own content kept. `WORKFLOW.md` and `AUDIT.md`
are taken whole, and `.github/skills` is re-vendored, adding
`update-host`.
- #600 resyncs the intent files. `global.json` pins the .NET 10 SDK line
with `latestFeature`, and the VS Code Lint tasks run through the hub's
`docker_lint.py` via a root `hub_fetch_run.py`. `OPERATIONS.md`
describes both.
- #598 replaces the two `Task.WhenAny(task, Task.Delay(timeout))`
teardown waits in `UtilitiesTests/LoopbackServer.cs` with
`Task.WaitAny`, because SDK 10.0.404 reports them as error CA2027.
`main` already carries the identical change from #599, so this file
merges with no diff.
- #595 is Dependabot's `Microsoft.NET.Test.Sdk` 18.11.1 -> 18.12.0 bump,
test-only.

`main` was also given the CA2027 fix directly in #599, so its own
Dependabot pull requests build again.

## Merge

A test merge of `develop` into `main` auto-merges cleanly, and its tree
equals `develop`'s tree (`0b7af164`). So this is a plain `develop ->
main` pull request with no `promote/` branch.

## Release

`releaseTrigger` is `two-phase`, so a maintainer merging this publishes
nothing by itself. Release goes through an explicit
`publish-release.yml` dispatch on `main`. Among the publisher's push
paths, only `Directory.Packages.props` differs from `main`, through the
test-only bump in #595.

## Audit

`audit run 2026-11-12T23:18:04Z | hub 009d3e5e | branch override
develop` reports 0 defect findings on `develop`. Two date-only intent
advisories remain, on `.editorconfig-checker.json` and `version.json`,
whose content is this repository's own. Repository settings were applied
from the hub at `009d3e5e` with `repo-config/configure.sh apply`, adding
the `history-data` label, and `check` reports a match.

## Review coverage

Each feature pull request met every Merge Gate item at its merged head.
#597 had a Copilot round with a file table naming all 34 changed files,
and its one verdict headline was answered. #598 and #600 each had an
attested local pass covering the merged head. #600's three Copilot
threads were resolved: one fixed, and two declined as carried hub
content, tracked in ptr727/ProjectTemplate#4108. #595 is a Dependabot
dependency bump merged green.

## Findings Routed to the Hub

- The hub's VS Code tasks snippet runs `Lint: Prose` before `Lint: EOL`
in a stopping sequence, and its pre-commit comment does not fit a
.NET-only hook. Both points are reported on ptr727/ProjectTemplate#3536,
and this repository adapts its copy meanwhile.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Updated [ptr727.Utilities](https://github.com/ptr727/Utilities) from
4.1.112 to 4.1.119.

<details>
<summary>Release notes</summary>

_Sourced from [ptr727.Utilities's
releases](https://github.com/ptr727/Utilities/releases)._

## 4.1.119

## What's Changed
* Skip the Carried Verbatim Trees in the Reviewer Configs by @​ptr727 in
ptr727/Utilities#583
* Bump the actions-deps group with 4 updates by @​dependabot[bot] in
ptr727/Utilities#585
* Bump the nuget-deps group with 1 update by @​dependabot[bot] in
ptr727/Utilities#587
* Bump the Hub Reusable Workflow Pin to 2.0.1401 by @​ptr727 in
ptr727/Utilities#593
* Rename codecov.yml to .codecov.yml by @​ptr727 in
ptr727/Utilities#592
* Bump the nuget-deps group with 4 updates by @​dependabot[bot] in
ptr727/Utilities#591
* Promote Develop: Hub Pin 2.0.1401 and the .codecov.yml Rename by
@​ptr727 in ptr727/Utilities#594
* Promote Develop: Reviewer Config Exclusions by @​ptr727 in
ptr727/Utilities#584
* Bump the nuget-deps group with 1 update by @​dependabot[bot] in
ptr727/Utilities#595
* Bound the Loopback Server Teardown Waits With Task.WaitAny by @​ptr727
in ptr727/Utilities#598
* Bound the Loopback Server Teardown Waits With Task.WaitAny on Main by
@​ptr727 in ptr727/Utilities#599
* Resync the Instruction Set and Skills Tree With the Hub by @​ptr727 in
ptr727/Utilities#597
* Resync the Intent Files With the Hub by @​ptr727 in
ptr727/Utilities#600
* Promote the Hub Resync to Main by @​ptr727 in
ptr727/Utilities#601


**Full Changelog**:
ptr727/Utilities@4.1.112...4.1.119

Commits viewable in [compare
view](ptr727/Utilities@4.1.112...4.1.119).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ptr727.Utilities&package-manager=nuget&previous-version=4.1.112&new-version=4.1.119)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>