Fix source-flow PRs removing required darc-* feeds from NuGet.config

[Copilot]

Description

Source-flow PRs were removing darc-* feeds from NuGet.config even when dependencies still required them, causing restore failures. Forward flow merged Version.Details.xml changes but never recomputed NuGet.config feeds, unlike backflow which calls UpdateDependencyFiles.

Changes

Added UpdateNugetConfigFeedsAsync to ForwardFlowConflictResolver

• Reads merged Version.Details.xml from working tree
• Extracts dependency locations and flattens to feed URLs
• Updates NuGet.config via UpdatePackageSources
• Called after all version file merges in MergeDependenciesAsync

Updated ForwardFlowConflictResolverTests

• Added mocks for NuGet.config read/update operations
• Verifies feed recomputation during forward flow

Result

Forward flow now maintains feeds required by dependencies. Feeds only removed when dependencies migrate to nuget.org, not during source-flow PRs.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Source-flow PRs are removing required darc-* feeds added by dependency flow; automation should recompute feeds from Version.Details.xml</issue_title>
<issue_description>### Pull request

https://github.com/dotnet/diagnostics/pull/5645/files

Type of problem

Problem with version files (Versions.Details.xml, Versions.props, global.json, ..)

Description of the issue

Summary
In multiple recent PRs, a dependency-flow update correctly adds the necessary darc-* feed(s) to NuGet.config so the repo can restore serviced assets. A subsequent source-flow PR then removes those feed entries, breaking package restore. This is causing restore failures until the feeds are manually re-added.

“Unable to find a stable package Microsoft.CodeAnalysis.NetAnalyzers with version (>= 10.0.102)”
Analysis in the thread shows the PR removed the darc-pub feed that contained the 10.0.102 assets, leading directly to the restore failure.

Expected behavior (per Matt Mitchell (.NET))
After any dependency update, automation should examine the resulting Version.Details.xml, determine where each dependency is sourced, and compile the minimal set of darc-* feeds required to satisfy those dependencies. Only when assets are promoted (e.g., post-release) and the dependency locations switch to nuget.org should feeds be pruned. Current behavior appears to skip this reconciliation step in source-flow PRs.

Observed behavior

• Dependency-flow PR adds required darc-* feed(s) to NuGet.config.
• Source-flow PR later removes those feed entries, even though the dependency graph (per Version.Details.xml) still needs them, causing restore failures.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Source-flow PRs are removing required darc-* feeds added by dependency flow; automation should recompute feeds from Version.Details.xml #5623

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.