Migrate all NuGet publishing to Trusted Publishing

[TheAngryByrd]

What to build

Migrate MiniScaffold releases and generated library projects from long-lived NuGet API keys to NuGet Trusted Publishing.

Use NuGet/login@v1 to exchange GitHub OIDC tokens for short-lived NuGet API keys. Preserve the existing build contract and GitHub release behavior.

Update generated setup guidance and regression coverage. After a verified trusted publication, remove the reusable MiniScaffold credential.

Acceptance criteria

• Configure a nuget.org trusted-publishing policy with owner TheAngryByrd, repository MiniScaffold, workflow publish.yml, and environment nuget.
• Store the policy creator's NuGet profile name as NUGET_USER in the existing GitHub environment.
• Grant the publishing job id-token: write and the permissions required to create GitHub releases.
• Run NuGet/login@v1 immediately before publishing.
• Pass NUGET_API_KEY through the existing build input without changing the build-script publishing contract.
• Remove every publishing dependency on the long-lived NUGET_TOKEN secret. Do not add an automatic API-key fallback.
• Generate library projects with trusted-publishing permissions, login, and temporary-key wiring.
• Replace generated library and tutorial instructions for API-key creation with trusted-publishing policy and NUGET_USER setup.
• Add regression coverage for the generated workflow and setup instructions.
• Keep console templates unchanged because they do not publish NuGet packages.
• Verify that a tag-triggered MiniScaffold release publishes the package and creates its GitHub release.
• Verify that workflow logs contain no complete credential or credential fragments.
• After successful publication, confirm permanent policy activation, remove the GitHub NUGET_TOKEN secret, and revoke the old scoped key.
• Document how a maintainer can create a new scoped key for emergency recovery without restoring an automatic fallback.

Blocked by

• None — can start immediately.

References

• Use NuGet trusted publishing for releases ionide/ionide-analyzers#181
• https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing
• https://github.com/NuGet/login