[release-manager] Require package dependency closure for releases

[jeffhandley]

Update the release-manager agent and related skills to prevent publishing servicing releases with incomplete package dependency closures. That mistake was made with the v10.8.2 release where only Microsoft.Extensions.VectorData.ConformanceTests was published and Microsoft.Extensions.VectorData.Abstractions wasn't. This led to Microsoft.Extensions.VectorData.ConformanceTests failing to restore because its dependency wasn't met.

• Require release scope to include the full dependency closure of selected packages produced by dotnet/extensions
• Distinguish packages selected for their own changes from dependency-closure additions during human review
• Verify exact release-version dependencies resolve before publishing and during release validation
• Keep internal scope reasoning out of consumer-facing release notes

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

This PR updates the release-manager agent playbooks to prevent publishing a servicing (or otherwise scoped) release with an incomplete dotnet/extensions package dependency closure, by standardizing how scope is derived, approved, and validated pre/post publish.

Changes:

• Introduces a shared “package scope and dependency validation” reference that defines selected-vs-closure handling and exact-version dependency resolution requirements.
• Updates servicing/monthly release playbook stages (prepare, build, publish, validate) to derive an artifact-based manifest, require explicit human approval, and gate progress on dependency-resolution checks.
• Adjusts release-notes guidance to use the final published manifest (not a hand-curated subset) and to keep internal scope reasoning out of consumer-facing notes.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/agents/release-manager/write-release-notes/references/format-template.md	Patch-release template now expects the final published manifest (dependency closure included).
.github/agents/release-manager/validate-release/references/stage-5-verify-source-link.md	Stage 5 expanded to include dependency-resolution verification before Source Link/symbol checks.
.github/agents/release-manager/references/package-scope-and-dependency-validation.md	New shared invariant describing how to compute/approve scope and validate exact-version dependencies.
.github/agents/release-manager/publish-release/references/stage-4-publish-and-promote.md	Publish stage now requires an artifact-derived manifest + pre/post publish dependency validation.
.github/agents/release-manager/publish-release/references/stage-3-build-servicing.md	Servicing build stage now derives/approves the authoritative manifest from PackageArtifacts.
.github/agents/release-manager/prepare-release/references/stages-1-2-servicing-branch.md	Servicing prep now records selected roots vs provisional closure in the PR body and keeps closure provisional.
.github/agents/release-manager.agent.md	Agent contract updated to require the shared scope/dependency validation wherever scope is determined.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.