ci: the docs-tests SDK pin fails the Dependabot NuGet updater on master

[wallstop]

Description

The scheduled nuget in /.docs-tests Dependabot job fails on master. It is the only red
check on the default branch.

Failing run:

global.json file: /home/dependabot/dependabot-updater/repo/.docs-tests/global.json
Install the [9.0.314] .NET SDK or update [.../.docs-tests/global.json] to match an installed SDK.
System.Exception: Missing SDK, check global.json locations vs. job directories.

Root cause

.docs-tests/global.json pinned SDK 9.0.314 with "rollForward": "disable", and the
Dependabot updater container does not carry that exact build.

The reason only this one job fails, while the two SourceGenerators NuGet jobs pass with an
identical pin, is where the file sits relative to the job directory. Dependabot's NuGet
updater enforces a global.json inside the job directory:

global.json	Dependabot job directory	Enforced?
.docs-tests/global.json	/.docs-tests	yes - same directory
SourceGenerators/global.json	/SourceGenerators/WallstopStudios.DxMessaging.SourceGenerators and .../.Tests	no - one level above

What #352 changed

.docs-tests/global.json relaxed to "rollForward": "latestMinor". SourceGenerators/global.json
is deliberately left at disable: its exact SDK is load-bearing for the reproducible analyzer
payload npm run check:analyzers verifies, and CONTRIBUTING.md documents it.

Local SDK selection is unchanged (dotnet --version in .docs-tests still resolves 9.0.314) and
the docs suite stays 441/0, so nothing about how doc snippets are compiled moves.

Why this issue is still open

Whether the relaxation actually satisfies Dependabot is unverified. It depends on which 9.x
SDKs the updater image carries, and that job only runs on a schedule against master - it cannot
be exercised from a pull request. If the container has no 9.x SDK at or above 9.0.314, the job
will keep failing and the fix needs to go further (for example latestMajor, or dropping the
docs-tests pin entirely and letting the project use whatever SDK is present).

Expected Behavior

The scheduled Dependabot NuGet job for /.docs-tests succeeds and master has no red checks.

Actual Behavior

The job fails during discovery before it can propose any update, so .docs-tests NuGet
dependencies are silently not being updated.

Next step

Check the first scheduled run after #352 merges. If it is still red, attach the log here and take
the next option above.

[wallstop]

Verified the scheduled post-fix Dependabot run on current master: run 32086288463 completed successfully on 2026-08-18 at 142c2da5. Its Dependabot job and Run Dependabot step both concluded success, proving the flexible .docs-tests/global.json pin works in the updater image. Closing as resolved.