Pin .NET SDK provisioning to published releases #764

🤖 Generated by the Agentic Engineer

Problem

The unchanged post-merge CI at 5df28658db1fcb1484d5358d0580a3853e653ecc fails before its .NET fixture tests run. Four completed jobs request SDK 9.0.320 or 10.0.403 through floating 9/10 selectors, and the installer receives HTTP 409. The source-mapping fixture and ordinary/Microsoft.Testing.Platform Windows fixtures all show this failure.

Microsoft's published release metadata currently lists 9.0.319 and 10.0.402, with runtimes 9.0.21 and 10.0.13. The installer also attempts the unavailable 10.0.14 runtime. A source-retirement PR did not change these provisioning declarations; rerunning the same floating requests does not repair their cause.

Outcome

Provision released, exact SDK versions for both supported generations. Preserve all existing real .NET fixtures, coverage, source-mapping, expected-failure and OS controls.

Acceptance

• The shared test action and its native CI setup callsites use published exact SDK versions, retaining both .NET 9 and .NET 10.
• Regression coverage rejects floating SDK declarations and proves removal or alteration of the actual setup binding cannot pass unnoticed.
• Existing fixture/gate lockstep and local required checks pass; fresh native Linux, Windows and macOS .NET jobs pass at the reviewed head.
• Deliver through signed commits, substantive review, protected merge and successful default-branch verification.

Primary metadata: https://builds.dotnet.microsoft.com/dotnet/release-metadata/10.0/releases.json and https://raw.githubusercontent.com/dotnet/core/main/release-notes/9.0/releases.json . This is a bounded default-branch recovery; broader version-update automation remains tracked in #627.