Fix release: the privileged publish job has no checkout to read global.json from

[jecacs]

The publish-package job deliberately runs without a checkout: it is the privileged job that holds
id-token: write for NuGet Trusted Publishing, so repository content is kept out of it on purpose.
Pointing its setup-dotnet at global-json-file: global.json therefore asked for a file that does not
exist in that job, and the v3.1.0 release failed with:

Error: The specified global.json file 'global.json' does not exist

That step never restores or builds — it only runs dotnet nuget push and dotnet nuget verify — so the
SDK version cannot influence any packages.lock.json. It also already pins determinism itself: the next
step writes an isolated global.json into RUNNER_TEMP with rollForward: disable and asserts that
dotnet honours it.

So this restores the explicit dotnet-version: 10.0.x for that one step and records why it differs from
every other setup-dotnet in the repository.

The other five setup-dotnet steps were audited and all have a checkout earlier in their job:
ci.yml (build-and-test, aot-smoke), release.yml (validate), codeql.yml, security.yml.

Nothing was published to NuGet by the failed run — 3.1.0 is still absent from nuget.org — so the tag can
be repointed at the merge commit once this lands.