Add a root nuget.config with package source mapping

[brenpike]

Found during a repeat repo-wide read-only security sweep (2026-08-23).

Severity: info. Most of the risk here is already closed.

Current state

The supply-chain controls in place are good: RestorePackagesWithLockFile in both csproj files, dotnet restore --locked-mode in CI and in the documented local validation flow, content hashes in packages.lock.json, and NuGetAuditMode=all with NU1901-NU1904 treated as fatal (src/Directory.Build.props).

Gap

There is no root nuget.config, so the package source set depends on the machine default rather than being pinned by the repository.

Requested change

Optional: add a root nuget.config pinning nuget.org as the sole source, with package source mapping, to make resolution explicit and machine-independent. Non-breaking.