Improve dependency update workflow

[jongalloway]

Summary

• split NuGet updates into coherent workshop units instead of one repository-wide group
• isolate protected dependencies and major updates while preserving coordinated package sets
• add Part 3 checkpoint coverage
• add a dependency review skill with explicit merge, repair, defer, and close-and-regenerate dispositions
• link the canonical dependency policy to the review workflow

Validation

• npx --yes yaml-lint@1.7.0 .github/dependabot.yml
• repository Markdown lint command
• changed-file Markdown link check
• git diff --check
• VS Code diagnostics: no errors

[Copilot]

Copilot review overview

🟡 Changes recommended

The review procedure currently instructs branch mutation before the required explicit authorization.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	.github/​skills/​dependency-update-review/​SKILL.md — Guardrail 4 requires an explicit user request before changing PR state, but this step directs the…

What changed in this PR

Restructures dependency automation around workshop units and adds consistent review guidance. No package versions change.

Disposition: repair

Changes:

• Groups Dependabot updates by workshop progression and dependency risk.
• Adds Part 3 checkpoint coverage.
• Adds and links the dependency review skill.

File	Description
.github/​dependabot.yml	Defines scoped NuGet update groups.
.github/​skills/​dependency-update-review/​SKILL.md	Adds the dependency review workflow.
docs/​instructor/​DEPENDENCY_POLICY.md	Links the policy to the review skill.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Fixed in c0a1234 (see latest commit): scope establishment now only checks whether the branch is behind, without updating it. Branch updates now happen only during an explicitly requested repair.

[Copilot]

Correction: the fix is in commit 5d7a91e. Scope establishment now only checks whether the branch is behind, without updating it; branch updates happen only during an explicitly requested repair.