Guard the two pinned dependencies, and let small-suite readers self-select out

[SebHenn]

Handles the three things left open after #7: the two red Dependabot PRs, and issue #6.

Dependabot guards

#9 and #10 both broke the build on their first run, for reasons the comments already sitting beside those packages in Directory.Packages.props predicted. Both are now closed with the evidence, and this adds ignore rules for major bumps so they do not come back next Monday.

Microsoft.Testing.Extensions.TrxReport 1.9.1 → 2.3.3 is the one worth reading about. It restored and compiled with zero warnings, then failed at run time:

System.TypeLoadException: Could not load type
'Microsoft.Testing.Platform.Extensions.TestHost.IDataConsumer'
from assembly 'Microsoft.Testing.Platform, Version=2.3.3.0'

xunit.v3 3.2.2 is built against MTP 1.9.x, and NuGet unified the platform upward with no downgrade warning. Reproduced on Windows locally and on Linux in CI: baseline 177 passed with a TRX written, bump zero tests run and no TRX. No TRX is what the mutation harness reports as inconclusive rather than as a failure — the shape of breakage easiest to wave through and hardest to notice later.

docs/usage.md already stated the constraint. It just was not written anywhere Dependabot could read it, and excluding the fixture solutions was not enough because the root manifest carries TrxReport too.

Microsoft.Build.Framework 17.11.48 → 18.8.2 fails louder — MSBL001, because 18.x pulls in Microsoft.NET.StringTools without ExcludeAssets="runtime". Fixable, but not worth fixing: the package is referenced only so it can carry that attribute, since MSBuildLocator resolves the real MSBuild from the SDK. A newer version buys nothing and risks the one subsystem where a mistake shows up as a workspace that fails to load.

README (closes #6)

The break-even arithmetic was already on the page — at the bottom, under a heading that reads like marketing. The reporter measured a 12-second suite, correctly decided against adopting, and only got there after reading most of the README. A new section near the top gives the rule of thumb (more than about a minute) and points at the threshold every run already prints.

The same report found two things buried that change a reader's mind rather than confirming it: the .NET 10 / MTP framing reads as though MTP is required (xUnit v2 on VSTest has always worked), and shadow mode — the only feature that lets a reader verify the accuracy claims against their own history — was a bullet nine sections down. Both are now surfaced up top.

Safety

Not applicable. Configuration and documentation only; nothing touches selection, the graph, a widening, the cache key or a filter dialect.

Checklist

• Tests cover the change — n/a, no code changed
• dotnet build --configuration Release clean locally (.NET 10.0.302)
• dotnet test tests/Tia.Core.Tests — 177 passed, TRX written, on the unbumped baseline
• Docs updated — docs/maintaining.md now records the required status checks as live rather than pending, since Actions is operational again

🤖 Generated with Claude Code