Follow-up to #422, from Copilot review on the promotion PR #423.

`AUDIT.md` is explicitly read-only: its secrets check is

```sh
grep -qx "$s" <<<"$names" && echo "$store/$s: present" || echo "$store/$s: MISSING (defect)"
```

-- `echo`-based, with no defined non-zero exit contract. But two
`WORKFLOW.md` sentences still said the audit "asserts" the names exist
and "fail[s] if it cannot query them". That wording is a leftover from
when `configure.sh check` performed the audit and exited non-zero on
drift; #422 moved the audit to AUDIT.md but left these two clauses
describing the old behavior.

Both now describe what AUDIT.md actually does: check the names, and
report a missing name or a failed query as a defect. The
App-installation sentence was adjusted for the same reason ("notes
rather than fails" -> "notes rather than reports a defect").

Docs-only; no shipped input, so no release impact.

Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

Promotion of the `WORKFLOW.md` drift fix to `main`.

## Contents

| PR | Change |
| --- | --- |
| #422 | Correct the 5D audit references (`configure.sh check`/`apply`
-> AUDIT.md) and the `NUGET_USERNAME` secret store |

Closes #421

## What was fixed

1. **`configure.sh check` / `apply` do not exist.** The script's
interface is `[owner/repo] [release|operational]`, so `check` parsed as
a *repository name* -- acting on the wrong target rather than erroring.
Auditing moved to `AUDIT.md` as a read-only procedure; `configure.sh`
only applies.
2. **`NUGET_USERNAME` store.** `WORKFLOW.md` claimed Actions-only while
`spec/secrets.json` and `AUDIT.md` claimed both. Resolved in favor of
both, matching the fleet hub's canonical `nuget-oidc` mechanism and live
repository state (the name is present in both stores).

Two further accuracy fixes came out of review: the NuGet.org
trusted-publishing policy is now correctly described as sitting
*outside* AUDIT.md's drift report, and the `configure.sh` model argument
note now covers the no-registry fallback to `release`.

## Release impact: no auto-publish

Docs-only. No shipped input (`Utilities/**`, `version.json`,
`Directory.Build.props`, `Directory.Packages.props`) is touched, so this
will correctly not trigger a stable release. NuGet stays at 4.0.18,
whose library content is already identical to `main`.

Updated [ptr727.Utilities](https://github.com/ptr727/Utilities) from
4.0.18 to 4.0.28.

<details>
<summary>Release notes</summary>

_Sourced from [ptr727.Utilities's
releases](https://github.com/ptr727/Utilities/releases)._

## 4.0.28

## What's Changed
* Bump the nuget-deps group with 3 updates by @​dependabot[bot] in
ptr727/Utilities#411
* Document the README + HISTORY cspell CI scope in CODESTYLE by @​ptr727
in ptr727/Utilities#413
* Document the README + HISTORY cspell CI scope (main-only) by @​ptr727
in ptr727/Utilities#414
* Bump actions/setup-dotnet from 5.4.0 to 6.0.0 in the actions-deps
group by @​dependabot[bot] in
ptr727/Utilities#415
* Bump actions/setup-dotnet from 5.4.0 to 6.0.0 in the actions-deps
group by @​dependabot[bot] in
ptr727/Utilities#416
* Refresh repo-config carry to current reference; add self-audit carry
by @​ptr727 in ptr727/Utilities#417
* Remove repo-wide analyzer relaxation and honor test cancellation by
@​ptr727 in ptr727/Utilities#418
* Add Codecov coverage shield to the README build status by @​ptr727 in
ptr727/Utilities#419
* Promote develop to main by @​ptr727 in
ptr727/Utilities#420
* Correct WORKFLOW.md audit flow and NUGET_USERNAME secret store by
@​ptr727 in ptr727/Utilities#422
* Describe the 5D audit as reporting defects, not failing by @​ptr727 in
ptr727/Utilities#424
* Promote develop to main by @​ptr727 in
ptr727/Utilities#423
* Spell out the up-to-date ruleset setting in the 5D audit summary by
@​ptr727 in ptr727/Utilities#425
* Promote develop to main by @​ptr727 in
ptr727/Utilities#426
* Bump DavidAnson/markdownlint-cli2-action from 24.0.0 to 24.1.0 in the
actions-deps group by @​dependabot[bot] in
ptr727/Utilities#429
* Bump the nuget-deps group with 1 update by @​dependabot[bot] in
ptr727/Utilities#431


**Full Changelog**:
ptr727/Utilities@4.0.18...4.0.28

Commits viewable in [compare
view](ptr727/Utilities@4.0.18...4.0.28).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ptr727.Utilities&package-manager=nuget&previous-version=4.0.18&new-version=4.0.28)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>