Central Package Management version pinning without project-level override boundary

Central Package Management is intended to provide a single source of truth for package versions in a solution using Directory.Packages.props and NuGet.config centralPackageVersions with ManagePackageVersionsCentrally enabled for SDK-style projects.

The design allows a project file to declare an explicit Version attribute on a PackageReference, which can override the centrally defined PackageVersion. There is no built-in permission boundary that blocks contributors from intentionally overriding a centrally mandated version, and transitive resolution continues to follow nearest-wins rules. Lock file generation can freeze the resolved graph, but it is opt-in and enforcement across CI requires separate policy.

The goal is to clarify the enforcement model for centrally mandated versions and the limits of the current configuration.

Does Central Package Management offer a configuration option to disallow project-level Version attributes on PackageReference? Under which NuGet client and MSBuild SDK versions is the override behavior defined for SDK-style projects? How does lock file generation interact with centrally mandated versions when a project-level override is present?