ci(hygiene): allow dotnet ecosystem (nuget+telemetry) so build/test can run

Yesterday's run reported Finding #5 because the sandboxed agent
runner couldn't reach api.nuget.org or
dc.services.visualstudio.com, so 'dotnet restore' failed and the
build/test hygiene check produced no signal. Added the 'dotnet'
ecosystem identifier to network.allowed so nuget restore + telemetry
are reachable inside the sandbox.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/hygiene-assessment.md

@@ -5,6 +5,10 @@ on:
   schedule: daily
   workflow_dispatch: {}
 permissions: read-all
+network:
+  allowed:
+    - defaults
+    - dotnet
 tools:
   github:
     toolsets: [default]