- ci-cd.md: new "Dependency management" section (CPM, NuGet audit, scheduled dependency-scan.yml); Dockerfile notes now list Directory.Packages.props and why it's required before restore. - CLAUDE.md: dependency convention (edit central Directory.Packages.props, never re-add Version=); correct the test framework note (NUnit, not xUnit). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>