[Maintenance] security: NuGet package signing (blocked on code-signing cert)

[Chris-Wolfgang]

Scope

Split from #106 (supply-chain hardening) because this piece is blocked on obtaining a code-signing certificate, whereas the SBOM / SLSA attestation / consumer-verification pieces can proceed without one.

Sign the released .nupkg with a verifiable code-signing certificate so consumers can run nuget verify on the package and be sure it came from this repo unaltered.

Two candidate paths

1. Traditional PKI (NuGet Trusted Signers) — buy a code-signing cert from a CA (DigiCert, Sectigo, SSL.com; typically $200–$500/yr for a standard code-signing cert, more for EV). Store the cert in a secure signing service (Azure Key Vault, GitHub-hosted signer, or a physical HSM) and invoke dotnet nuget sign in release.yaml. Consumers verify via nuget verify -Signatures <package>.nupkg.
2. Sigstore (keyless, OIDC-based) — no cert to buy; the workflow's OIDC identity is the signer. sigstore-cosign-style verification. Newer, less established in the .NET ecosystem, but no procurement path.

Prerequisite

• Decide between traditional PKI + purchased cert vs. Sigstore.
• If traditional: acquire the certificate and set up secure signing.

Acceptance criteria

• release.yaml signs the .nupkg before uploading to NuGet.org.
• nuget verify -Signatures succeeds on the published package.
• Consumer-verification section of SECURITY.md (per [Maintenance] security: Supply chain hardening — SBOM + SLSA attestation #106) documents how to validate the signature.

Notes

• Companion to [Maintenance] security: Supply chain hardening — SBOM + SLSA attestation #106 (SBOM + SLSA + consumer verification) — the other three pieces of that issue don't need a cert and can be worked in parallel.
• Tier-1 follow-up. Required by enterprise procurement + US EO 14028.
• Fleet-wide: same split applied across every Wolfgang.* library that ships a NuGet package (originated from [Maintenance] security: NuGet package signing (blocked on code-signing cert) ETL-Abstractions#353).
• Board: https://github.com/users/Chris-Wolfgang/projects/6