ci: converge PurchaseOrderService on safe validation

[natthapolvanasrivilai]

Outcome

Converges the current PurchaseOrderService implementation on develop, consolidates applicable Dependabot updates, and replaces deployment-capable branch workflows with validation-only CI.

Included

• preserves the current purchase-order implementation and exact shared-library contracts
• updates coverlet.collector to 10.0.1 and Microsoft.NET.Test.Sdk to 18.8.1
• reconstructs exact public-source Maliev.MessagingContracts 1.0.96-alpha and Maliev.Aspire.ServiceDefaults 1.0.89-alpha packages
• builds the production Dockerfile locally without registry credentials or pushes
• groups future minor/patch Dependabot updates
• keeps integration error-path tests fast without weakening production retry behavior

Validation

• exact dependency package reconstruction: pass
• isolated Release build: pass, 0 warnings/errors
• focused retry/error-path regression: 1/1 pass
• full Release tests: 88/88 pass
• dotnet format --verify-no-changes: pass
• actionlint: pass
• git diff --check: pass
• staged gitleaks scan: pass
• local production image build and metadata assertions: pass

Known test-only audit residual

SQLitePCLRaw.lib.e_sqlite3 2.1.11 remains behind the repository's existing narrow GHSA-2m69-gcr7-jv3q suppression. It is pulled only by EF Core's in-memory SQLite test dependency, is not shipped in the API image, and the available 3.x replacement is a breaking provider jump. The production image scan remains required.

No deployment, image push, GitOps write, or infrastructure mutation is performed.