Direct-only NuGet audit vs scheduled vulnerability listing for CI noise control

A design goal is to keep vulnerability alerts actionable in .NET SDK projects without flooding CI with transitive advisory noise.

Two documented approaches are available. Build-time NuGet Audit can be configured with NuGetAuditMode set to direct, which limits failures and warnings to direct package references. An alternative is on-demand vulnerability listing that produces a point-in-time report outside the build, leaving build behavior unchanged.

The constraint is to retain timely detection of newly introduced direct risks while avoiding alert fatigue from transitive dependencies, and to avoid silent gaps when advisory data is unavailable.

What coverage difference exists between direct-only audit and scheduled on-demand listing for newly added transitive risks? How does NuGetAuditSuppressions maintenance affect long-term signal quality in direct mode? Can both approaches be combined without duplicating alerts for the same advisory?