Migrate NuGet publishing to trusted publishing (OIDC)

Replace the long-lived NuGet API key secret with short-lived,
OIDC-issued credentials via NuGet trusted publishing:

- Add id-token: write permission for GitHub OIDC token issuance
- Add a NuGet/login@v1 step that exchanges the OIDC token for a
  short-lived API key (username from the NUGET_USER secret)
- Push using the short-lived key instead of
  secrets.SILLSDEV_PUBLISH_NUGET_ORG

The login step currently runs on every build (no gating condition)
to validate the trusted publishing policy end-to-end; it will be
restored to run only on publish once confirmed working.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hahn-kev

.github/workflows/nuget-ci-cd.yml

@@ -12,6 +12,7 @@ jobs:
   build:
     permissions:
       packages: write
+      id-token: write  # enable GitHub OIDC token issuance for NuGet trusted publishing
     runs-on: ubuntu-latest
 
     steps:
@@ -48,6 +49,12 @@ jobs:
           name: nuget-packages
           path: src/artifacts/package/release/*nupkg
 
+      - name: NuGet login
+        id: nuget-login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
       - name: Publish package to NuGet.org
         if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
         shell: bash
@@ -83,4 +90,4 @@ jobs:
               --source https://api.nuget.org/v3/index.json
           done
         env:
-          NUGET_API_KEY: ${{ secrets.SILLSDEV_PUBLISH_NUGET_ORG }}
+          NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}