[LarsLaskowski]

📖 Description

The dotnet profile now seeds a tool manifest .config/dotnet-tools.json that pins Reihitsu.Cli and dotnet-sonarscanner, so Dependabot can raise them together with Reihitsu.Analyzer. The profile's instructions and stack.md describe the formatter as restored with dotnet tool restore and run as dotnet tool run reihitsu-format, and the SessionStart hook relies on the restore alone instead of installing an unpinned global tool. apply-template keeps a repository's own root dotnet-tools.json instead of seeding a second manifest. core/docs/CONTRIBUTING.md now names the feature label for release notes and notes that the CI run of a first-time contributor's fork waits for a maintainer's approval. The lessons come from the squad run in Censio#3.

🎫 Issues

Closes #204

💬 Reviewer Notes

The pinned versions in the seed manifest (Reihitsu.Cli 1.1.0, dotnet-sonarscanner 12.0.0) are the latest on NuGet; the CI step that fails when formatter and analyzer leave the same release line is not part of this change.

✅ Checklist

• python3 tools/template-check.py passes.
• ruff check . and python -m unittest discover tools pass (if Python files changed).
• core/ stays stack- and project-neutral; stack details live in profiles/<stack>/.
• README.md is updated if the layout, a profile or a tool's behaviour changed.

🚀 Rollout

Repositories with the dotnet profile (PlexToJellyfinSync, Vandox, Censio, DockerUpdateGuard, F1-Telemetry) pick it up with the next adopt-template run.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
66.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud