Bump: skip local source-dep candidates for cross-family deps

When a consumer references the same logical product under multiple family
versions (e.g. Metalama.Vsx 2026.1 references Metalama 2026.1 and Metalama
2026.0 with alias "Metalama20260"), both iterations resolved to the same
local source-dep path because the candidate paths use only dependency.Name
without a version qualifier. Whichever branch ..\Metalama happened to be
on was used by both iterations, so the cross-family value was wrong.

Fix: when dependency.ProductFamily.Version differs from the consumer's
family version, skip the local candidates entirely and download from the
dep's release branch via VcsRepository.TryDownloadTextFile. Same-family
deps still prefer local checkouts.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: PostSharpAgent

src/PostSharp.Engineering.BuildTools/Build/Files/AutoUpdatedVersionsFile.cs

@@ -119,21 +119,30 @@ public static bool TryWrite(
         var errors = 0;
         string? inheritedMainVersion = null;
 
+        var consumerFamilyVersion = context.Product.DependencyDefinition.ProductFamily.Version;
+
         foreach ( var dependencyConfiguration in autoUpdatedDependencies )
         {
             var dependency = dependencyConfiguration.Definition;
 
-            string[] filePathCandidates =
-            [
-                Path.GetFullPath(
-                    Path.Combine(
-                        context.RepoDirectory,
-                        context.Product.SourceDependenciesDirectory,
-                        dependency.Name,
-                        dependency.EngineeringDirectory,
-                        FileName ) ),
-                Path.GetFullPath( Path.Combine( context.RepoDirectory, "..", dependency.Name, dependency.EngineeringDirectory, FileName ) )
-            ];
+            // Local source-dep paths use only dependency.Name (no version qualifier), so two references to the same
+            // logical product under different family versions — e.g. Metalama 2026.1 and Metalama 2026.0 (aliased) on
+            // Vsx 2026.1 — would resolve to the same local checkout, and both iterations would read whichever branch
+            // it happens to be on. For cross-family deps, skip local candidates and always download from the dep's
+            // own release branch on GitHub.
+            string[] filePathCandidates = dependency.ProductFamily.Version == consumerFamilyVersion
+                ?
+                [
+                    Path.GetFullPath(
+                        Path.Combine(
+                            context.RepoDirectory,
+                            context.Product.SourceDependenciesDirectory,
+                            dependency.Name,
+                            dependency.EngineeringDirectory,
+                            FileName ) ),
+                    Path.GetFullPath( Path.Combine( context.RepoDirectory, "..", dependency.Name, dependency.EngineeringDirectory, FileName ) )
+                ]
+                : [];
 
             var theirAutoUpdatedVersionsFilePath = filePathCandidates.FirstOrDefault( File.Exists );