Honor caller SDK pins in package updates

[woksin]

Changed

• Package updates install the caller's pinned .NET SDK alongside the shared SDK version without changing its roll-forward policy. (part of Reduce GitHub Actions jobs and runner queue time across the organization #128)

[woksin]

The owner-confirmed passing updater tests for this exact SDK-pin branch are reused; no code inputs changed after preparation. Other unchanged preparation checks: cleanup-pr-artifacts suite 35/35, bootstrap-package-update-safety suite 5/5, changed YAML actionlint. git diff --check origin/main...HEAD passed again after fetching main. Workflows contains no application solution/build gate.

This PR stays separate from the bootstrap/report follow-up so the package rollout safety gate remains narrowly scoped. It installs the SDK selected by global.json without rewriting the caller's version or roll-forward policy. No live package updates, publication, schedule restoration, secrets, or merge are included. CI results still need review before any later merge.