[albertospelta]

Problem

CI restore fails in locked mode with NU1004: Microsoft.NET.ILLink.Tasks changed from [10.0.11, ) to [10.0.12, ).

The SDK adds that package as an implicit reference, at the version of the runtime it bundles. global.json allowed rollForward: latestFeature, so setup-dotnet installed the newest .NET 10 SDK, which bundles runtime 10.0.12, while the lock file still expected 10.0.11. Every SDK servicing release would break CI the same way. A floating SDK also changes the runtime bundled in the self-contained executable and the analyzers (with AnalysisLevel=latest and -warnaserror), with no commit recording it.

Changes

• global.json: pin the SDK to 10.0.401 with rollForward: disable, so CI and local builds use the same toolchain and runner-preinstalled SDKs are not picked up
• src/DaxLib.Mcp/packages.lock.json: regenerated with that SDK (Microsoft.NET.ILLink.Tasks 10.0.12)
• AGENTS.md: explain why the SDK is pinned and how to update it together with the lock files
• .github/dependabot.yml: monthly updates for the .NET SDK (minor and patch only), NuGet packages (grouped), and GitHub Actions

Notes

• Dependabot PRs for the SDK will fail CI until the lock files are regenerated: check out the branch, run dotnet restore DaxLib.Mcp.slnx --force-evaluate, commit, and push.
• Runtime security patches now reach the executable only through an SDK update, so those Dependabot PRs are worth merging promptly.
• Contributors need SDK 10.0.401 installed.

Verification

Locally, with RestoreLockedMode=true: dotnet build -warnaserror, dotnet test, and dotnet publish --runtime win-x64 --self-contained all succeed. CI on this PR confirms that setup-dotnet installs the pinned SDK.