deps-update: implement 7-day NuGet supply-chain quarantine (dotnet-outdated has no built-in filter) #237

Follow-up from PR #225 review (F-CR-002 second half, F-SEC-005).

Current behaviour

Three of the four ecosystems the weekly deps update touches enforce a 7-day supply-chain quarantine:

• GitHub Actions + Dockerfile bases — via Renovate's minimumReleaseAge.
• npm packages — via npm-check-updates --cooldown "$MIN_AGE_DAYS" (added in the same PR that filed this issue).
• NuGet packages — no quarantine. dotnet-outdated has no built-in age filter, so a hot-published bad NuGet release will land in the weekly PR unfiltered; CI + reviewer eyes are the only defence.

Options

• Wrap dotnet-outdated's output with a pre-processor that queries nuget.org REST for each candidate version's published timestamp and drops anything younger than $MIN_AGE_DAYS.
• Switch the NuGet driver to a tool that supports a cooldown natively (Dependabot's grouping config, or Renovate's NuGet manager) — a bigger change, and Dependabot bulk PRs need the shared-branch invariant reworked.
• Cut a small wrapper CLI (tools/ci/nuget-cooldown.ts) that walks each .csproj, queries nuget.org, and lists only the eligible bumps that dotnet outdated --upgrade then applies.

Acceptance

• Weekly NuGet bumps land only versions whose published timestamp on nuget.org is at least env.MIN_AGE_DAYS days old.
• The workflow header comment + docs/development/deps-update.md are updated to remove the "NuGet does NOT enforce the quarantine" caveat once the fix ships.
• A test / dry-run harness verifies the cooldown is applied.

Filed as a follow-up so PR #225 can merge without adding a new CLI to the release pipeline.