Migrate to release-please and NuGet Trusted Publishing (OIDC)

[perkops]

Summary

• Replace the branch-promotion release flow with release-please
• Publish to NuGet via trusted publishing (OIDC), dropping API keys
• Drop Nerdbank.GitVersioning for a release-please-managed version
• Version all three packages in lockstep from one tag
• Make NuGet packability explicit on every project

Changes

👷 CI/CD

• Add release-please workflow that packs and pushes on release
• Publish via NuGet trusted publishing using short-lived OIDC keys
• Grant id-token: write and drop the static NuGet API key
• Scope push globs to the three real package ids
• Retain the ATC-API cache invalidation after publish
• Rename pre-integration.yml to build.yml
• Run the build workflow on pushes to main and on PRs
• Pin all workflow actions to commit SHAs
• Preserve job ids so required status checks still match

🔧 Configuration

• Add release-please-config.json and manifest, seeded at 1.0.392
• Stamp version into Directory.Build.props via release markers
• Set bootstrap-sha so the first changelog starts clean
• Set IsPackable explicitly on all src projects
• Exclude all sample projects from NuGet packaging

🔥 Removal

• Delete the post-integration.yml and release.yml workflows
• Remove the main to stable to release branch promotion chain
• Remove the GitHub Packages pre-release feed
• Delete version.json and the Nerdbank.GitVersioning reference