Restore NuGet packages in Docker with committed lock files and locked mode #315

Parent: #244
Epic: #15
Severity: High supply-chain integrity
Execution mode: AFK

What to build

Make the production Docker build consume the same deterministic NuGet graph enforced by CI. The current Dockerfile copies project files but not Directory.Build.props or packages.lock.json before dotnet restore, and restore does not pass --locked-mode. The image build can therefore resolve a graph that differs from the reviewed and CI-restored locks.

Preserve useful Docker layer caching while copying every restore input needed by the API project and its referenced projects before the restore layer.

Acceptance criteria

• Directory.Build.props, relevant project files, NuGet configuration, and all relevant packages.lock.json files are present before the Docker restore layer.
• The restore command uses --locked-mode and the publish step remains --no-restore.
• A Docker build succeeds from a clean checkout with the committed lock graph.
• A test that changes a PackageReference without refreshing its lock file makes the Docker restore fail closed.
• CI builds and scans this exact Dockerfile path after the change.
• Docker cache behavior remains documented and does not copy the full source tree before restore unnecessarily.

Blocked by

None.