Isolate specialized Dependabot updates

.github/dependabot.yml

@@ -24,12 +24,22 @@ updates:
       major-updates:
         patterns:
           - "*"
+        exclude-patterns:
+          - "Microsoft.Bcl.Memory"
+          - "Microsoft.Extensions.DataIngestion*"
+          - "Microsoft.SemanticKernel.Connectors.SqliteVec"
+          - "SQLitePCLRaw.bundle_e_sqlite3"
         update-types:
           - "major"
         group-by: "dependency-name"
       routine-minor-patch:
         patterns:
           - "*"
+        exclude-patterns:
+          - "Microsoft.Bcl.Memory"
+          - "Microsoft.Extensions.DataIngestion*"
+          - "Microsoft.SemanticKernel.Connectors.SqliteVec"
+          - "SQLitePCLRaw.bundle_e_sqlite3"
         update-types:
           - "minor"
           - "patch"
@@ -79,12 +89,22 @@ updates:
       major-updates:
         patterns:
           - "*"
+        exclude-patterns:
+          - "Aspire.AppHost.Sdk"
+          - "Microsoft.OpenApi"
+          - "Microsoft.SemanticKernel.Connectors.SqliteVec"
+          - "SQLitePCLRaw.bundle_e_sqlite3"
         update-types:
           - "major"
         group-by: "dependency-name"
       routine-minor-patch:
         patterns:
           - "*"
+        exclude-patterns:
+          - "Aspire.AppHost.Sdk"
+          - "Microsoft.OpenApi"
+          - "Microsoft.SemanticKernel.Connectors.SqliteVec"
+          - "SQLitePCLRaw.bundle_e_sqlite3"
         update-types:
           - "minor"
           - "patch"
@@ -113,6 +133,10 @@ updates:
       routine-minor-patch:
         patterns:
           - "*"
+        exclude-patterns:
+          - "Aspire.*"
+          - "Microsoft.Bcl.Memory"
+          - "Microsoft.Extensions.DataIngestion*"
         update-types:
           - "minor"
           - "patch"

.github/skills/dependency-update-review/SKILL.md

@@ -88,6 +88,7 @@ Then scale validation to risk:
 | Compatibility boundary or major | Compile dependent/generated code and run the relevant lab flow |
 | Coordinated set | Build and exercise every member of the set together |
 | Template baseline or prerelease | Re-scaffold, compare, and run the affected attendee flow |
+| Fast-moving AI framework minor | Inspect release notes and run the affected lab flow when behavior or APIs changed |
 
 Do not substitute a repository-wide green build for a required template or runtime
 check.
@@ -104,6 +105,15 @@ After repairs, rerun the failed focused check first, then all validation require
 by the classification. Run Markdown lint and link checks when documentation
 changes, and finish with `git diff --check`.
 
+Before marking a repaired PR ready to merge:
+
+- Compare the final diff with the PR title and description. Remove generated
+  package entries and release notes for updates that were reverted, and correct
+  package counts.
+- Record retained protected pins and their policy rationale in the PR description.
+- Reply to each addressed review comment with the repair and validation evidence,
+  then resolve the thread.
+
 ## Disposition rules
 
 - **merge:** The update is current, coherent, policy-aligned, documented where
@@ -127,4 +137,5 @@ Return:
 3. **Classification:** one row per package or coordinated set.
 4. **Findings:** blockers and risks, highest severity first, with file references.
 5. **Validation:** commands run and their outcomes, including skipped checks.
-6. **Required action:** the smallest next step that makes the disposition actionable.
+6. **Required action:** the smallest next step that makes the disposition actionable
+  and reviewable.

docs/instructor/DEPENDENCY_POLICY.md

@@ -75,6 +75,9 @@ to apply this checklist consistently to Dependabot and manual package updates.
    prerelease, template, or provider changes, also run the relevant attendee flow.
 1. Record why a protected pin changed or was removed in the pull request and update
    this inventory in the same change.
+1. After repairing a generated dependency pull request, reconcile its title and
+  description with the final diff and resolve review threads only after recording
+  the validation evidence.
 
 Use the `workshop-testing` skill when an update requires re-scaffolding a project,
 reconciling a snapshot, or exercising the workshop as an attendee.