feat(release): Nerdbank.GitVersioning + GitHub Actions release pipeline

[ChrisonSimtian]

Summary

Versioning moves from GitFlow-driven GitVersion to trunk-based Nerdbank.GitVersioning. Adds the missing release pipeline so merges to `main` can publish — to GitHub Packages on this fork, not nuget.org. (See "Why GitHub Packages" below.)

Versioning

• `version.json` — Nerdbank config. `version: "10.2"`, `publicReleaseRefSpec` scoped to `main` (stable versions only on main, prereleases elsewhere), SemVer 2 NuGet output, assembly version pinned to `major.minor` for binding stability.
• `Directory.Packages.props` — Nerdbank.GitVersioning 3.7.115.
• `source/Directory.Build.props` — `PackageReference` with `PrivateAssets="All"` so the package isn't a transitive dep of consumers.

GitVersion is still installed (transitionally) because Build.cs's `MajorMinorPatchVersion` reads from it for the GitHub release name + milestone title. Full GitVersion removal is a follow-up.

Why GitHub Packages, not nuget.org

Per Matt's wish, the "Nuke" name cannot be carried over to a successor project. Publishing to nuget.org would require a new name we don't have yet. Until the hard-fork rename ceremony happens, the release pipeline publishes to GitHub Packages on this fork (`https://nuget.pkg.github.com/ChrisonSimtian/index.json\`).

Switching the target back to nuget.org becomes a one-line follow-up once we have a name.

Release pipeline

`.github/workflows/release.yml` — hand-written, not auto-generated. Triggered on push to main, fetch-depth 0 (Nerdbank), runs `./build.cmd Test Pack Publish`.

Auth

Uses the auto-provided `GITHUB_TOKEN` (the workflow already declares `permissions: packages: write`). No separate NuGet API key needed. When we eventually point publishing at nuget.org, that's when we'll add a `NUGET_API_KEY` secret.

Why hand-written

The NUKE `[GitHubActions]` attribute generator would force the GitHub secret name to match the NUKE parameter name. Hand-writing the workflow lets the C# parameter stay idiomatic (`NuGetApiKey`) while the workflow uses `GITHUB_TOKEN` directly.

Build.cs simplification

• Drop `FeedzNuGetSource` / `FeedzNuGetApiKey` / `IsPublicRelease` — no alpha feed in trunk-based.
• Rename `PublicNuGetApiKey` → `NuGetApiKey`.
• `IPublish.NuGetSource` now derives from `GITHUB_REPOSITORY_OWNER` (with `ChrisonSimtian` local fallback) → GitHub Packages URL.
• `Pack.SetVersion(9999.0.0)` only applies for `Terminal` (local) builds; CI lets Nerdbank's MSBuild version stand.
• `Test.OnlyWhenStatic` guard removed (was excluding alpha-deployment).
• `DeletePackages` now only handles the Terminal case (cleans local 9999.0.0 packages).
• `Build.SignPackages.cs` `IsPublicRelease` → `IsOnMainBranch`.

Workflow constant

`Build.CI.GitHubActions.cs` — `AlphaDeployment` → `ReleaseWorkflow`. `Publish.Requires` now checks `Workflow == ReleaseWorkflow`.

Versioning expectations

Once merged:

Ref	Output version
`main` (first commit after this)	`10.2.` — stable, published to GitHub Packages
Any feature branch	`10.2.-.+` — prerelease
Tag `v10.2.0`	`10.2.0` exactly

Minor bumps (10.2 → 10.3): edit `version.json` or run `nbgv prepare-release`.

Test plan

• `dotnet restore nuke-common.slnx` — Nerdbank.GitVersioning 3.7.115 resolves on all 26 projects
• `dotnet build build/_build.csproj` — 0 errors after edits (warnings dropped from 59 → 9 thanks to chore(deps): patch vulnerable transitives (CVE-2026-33116, Scriban) #4 already on main)
• Validation workflow (ubuntu-latest) green on this PR
• After merge: `release.yml` triggers, Test+Pack succeed, Publish hits GitHub Packages successfully (no manual secret setup needed)

Follow-ups (separate PRs, not blocking this)

• Fully remove GitVersion (replace `MajorMinorPatchVersion` with Nerdbank-derived equivalent)
• Decide fate of `Build.Announce.cs` (orphaned since AppVeyor drop)
• Switch publish target to nuget.org after the project rename happens

🤖 Generated with Claude Code