ci: stop the chore block bumping shipped dependencies

[Ank-KhoaHo]

Both /src/ blocks ignore dependency-name: "*" and propose nothing, and their comment says bumps
there "stay a deliberate manual act". They did not. The tests block reaches src/ through
ProjectReference, Dependabot edits the src csproj on its way past, and that block carries
prefix: chore — hidden and non-bumping.

So the only automated path that touched a shipped dependency was the one whose own header says
"these do not ship, so they stay out of the public changelog."

What it cost

#366, titled "Bump the test-dependencies group with 10 updates", bumped seven shipped runtime
dependencies: OfficeIMO 3.2.2 → 3.2.6 across eight packages, AngleSharp 1.7.1 → 1.7.2, PdfPig
0.1.15 → 0.1.16. OfficeIMO is the engine behind every DOCX, XLSX, PPTX and PDF path here.

Under chore: a consumer restores four patch versions of different rendering code with no changelog
entry and no version proposed. It also truncated all eight lockfiles, exactly as the /src/ blocks
predict — so the brokenness those blocks were disabled to avoid arrived anyway, under a different
label.

Why the existing guard passed

check-dependabot-scoping.py was right about what it checked, and its own comment named the
hole:

The NAMED rules still have to be repeated. A wildcard in src/ stops Dependabot proposing bumps
rooted there; it does nothing about a bump proposed from the tests or root block that edits a src
csproj on its way past.

It required the 4 named rules. src/Directory.Build.props declares 15 packages, and only
SixLabors.Fonts was in both sets — leaving 14 reachable and bumpable.

Discarding "*" stays, and is right: requiring the tests block to repeat it would stop test
dependencies updating at all, for a reason that has nothing to do with them.

The fix

All fifteen are ignored in both blocks that reach src/, and the requirement is derived from
the props file rather than listed — the same principle as gen-third-party-notices.py reading the
lockfile.

Verified by sabotage in both directions, because a derived check has two ways to go quiet:

sabotage	result
delete one shipped ignore	1 error, naming it
add a sixteenth package to the props	required set grows to 19; tests block reported MISSING it

The second is the one that matters — a hand-written list passes that case, which is how four rules
came to cover one of fifteen packages. The script also refuses to run if the props file is missing
or parses to zero references, rather than quietly requiring less.

Not in scope

Whether shipped bumps should be automated under build: instead. That is a separate decision and
the /src/ blocks' lockfile reasoning argues against it. dependency-report.yml already delivers
the information weekly, read-only, which is what those blocks say was actually wanted.

Closes C37.