fix(release): switch NuGet publishing to trusted publishing - #500

The latest release failed on the first NuGet push because the stored NUGET_KEY had expired: https://github.com/finos/morphir-dotnet/actions/runs/42360680040. Deployment now exchanges a GitHub OIDC token through the pinned NuGet/login v1.2.0 action immediately before publishing, and passes only that temporary credential to PublishAll. The stored NuGet keys are no longer read.

The publishing job uses the production environment to match the newly created NuGet policy. Only that job receives id-token: write. A preflight check reports a missing NUGET_USER, and the deployment guide now documents the policy, scopes and recovery steps. Regression tests cover temporary credential use, OIDC permission scope and the required environment.

Repository setup completed: NUGET_USER=DamReev and the production Actions environment. The NuGet policy shown by the maintainer is active for package owner Morphir, glob Morphir*, finos/morphir-dotnet, deployment.yml, environment production, with permission to push new packages and versions. Live OIDC exchange remains to be verified by the next deployment.

Validation:

• All 52 build/package tests pass, including three publishing regression tests. Each new contract was checked red before updating the workflow, then green.
• C# formatting verification and git diff --check pass.
• actionlint passes with ShellCheck disabled. With ShellCheck enabled, both main and this branch report the same five pre-existing findings in version extraction.
• Full TestAll attempted. Build/package validation passed; the unit suites finished with one Tooling BDD failure, Complete typed objects reach the reusable editor, matching the Windows config.edit_rolled_back issue Configuration edits roll back on transient Windows file locks #496. That scenario passed on its single isolated retry. Other suites passed; no application code changed.

After merge, start a new deployment workflow_dispatch on main for 0.4.0-alpha.1. Re-running the old failed run would keep its stored-key workflow. This PR does not trigger publication or move the existing tag.