Migrate to release-please and NuGet Trusted Publishing (OIDC)

[perkops]

Summary

• Replace git-height versioning with release-please
• Publish to nuget.org via short-lived OIDC credentials
• Retire the main/stable/release promotion chain
• Reduce workflows to build.yml and release-please.yml
• Align release tooling with atc-aspire and atc-claude-kanban

Changes

👷 CI/CD

• Add release-please.yml driving version, tag and release
• Pack and push gated on release_created in the same job
• Obtain a short-lived NuGet key via NuGet/login (OIDC)
• Grant id-token: write instead of using a static API key
• Pin all external actions to commit SHAs
• Run release-please with a PAT so tags trigger workflows
• Carry over the ATC-API cache invalidation step
• Rename pre-integration.yml to build.yml
• Build and test on pushes to main, not just pull requests
• Add tags-ignore so release tags skip the build matrix

🔧 Configuration

• Add release-please-config.json using release-type simple
• Seed .release-please-manifest.json at 2.0.268
• Set bootstrap-sha so the first changelog starts fresh
• Stamp Version into Directory.Build.props via markers
• Set IsPackable explicitly on all four src projects

🔥 Removal

• Delete release.yml and post-integration.yml
• Delete version.json and the Nerdbank.GitVersioning ref
• Delete the scheduled integration-tests workflow
• Delete the scheduled atc-coding-rules-update workflow
• Drop the NUGET_KEY secret from the publish path