ci(publish): future-proof Must-Publish gate + ship BitNet 1.4.10

Two coupled fixes to land ANcpLua.Agents.Hosting.BitNet on nuget.org:

1. Must-Publish gate now also considers `.github/workflows/nuget-publish.yml`
   in its diff filter and supports a `force_publish` workflow_dispatch input.
   Rationale: v1.4.9 shipped without BitNet because the previous pack step
   simply lacked the line — and the follow-up `0a0b637` fix that *added*
   the line couldn't itself publish, because the gate only looked at
   src/** and tests/**. A change to publish-workflow IS a release-relevant
   change when it controls which packages get packed. Without this fix,
   any future "I missed packing package X" recovery hits the same trap.

2. Add `<PackageReleaseNotes>` to the BitNet csproj — a real src change
   that clears the gate on this commit and gives consumers a meaningful
   note about the auto-Docker fixture and LegacyMaxTokensPolicy shim.

Verified locally: `dotnet pack -p:Version=1.4.10-alpha.1` produces a
valid nupkg containing the nuspec, README.md, and the bundled
analyzers/dotnet/cs/ANcpLua.Agents.Hosting.BitNet.Generators.dll
(286 KB) — same shape as Hosting.OpenAI's published alpha artifacts.

Unblocks #143 (SDK variant) and #330 (qyl.loom wire-up) in clean CI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ANcpLua

.github/workflows/nuget-publish.yml

@@ -10,6 +10,11 @@ on:
       version:
         description: 'Version override (without v prefix). Leave empty to auto-bump from latest tag.'
         required: false
+      force_publish:
+        description: 'Force publish even when the Must-Publish gate sees no src/tests/publish-workflow changes.'
+        required: false
+        type: boolean
+        default: false
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -152,21 +157,31 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      # Publish only when there are real release-relevant changes since LATEST_TAG. "Release-
+      # relevant" is anything under src/** or tests/**, OR the publish workflow file itself
+      # (because that file controls *which* packages get packed — a missing-pack-line fix is a
+      # legitimate publish trigger, as PR #80 → v1.4.9 demonstrated when BitNet was silently
+      # dropped from the artifact bundle).
       - name: Must Publish Packages
         id: has_changes
         run: |
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ] && [ "${{ github.event.inputs.force_publish }}" == "true" ]; then
+            echo "Workflow dispatch with force_publish=true — bypassing gate"
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
           LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
           if [ -z "$LATEST_TAG" ]; then
             echo "No previous tag — first publish, proceeding"
             echo "has_changes=true" >> $GITHUB_OUTPUT
           else
-            CHANGES=$(git diff --name-only "$LATEST_TAG" HEAD -- 'src/**' 'tests/**' || true)
+            CHANGES=$(git diff --name-only "$LATEST_TAG" HEAD -- 'src/**' 'tests/**' '.github/workflows/nuget-publish.yml' || true)
             if [ -n "$CHANGES" ]; then
               echo "Changes since $LATEST_TAG:"
               echo "$CHANGES"
               echo "has_changes=true" >> $GITHUB_OUTPUT
             else
-              echo "No src/ or tests/ changes since $LATEST_TAG — skipping publish"
+              echo "No src/, tests/, or publish-workflow changes since $LATEST_TAG — skipping publish"
               echo "has_changes=false" >> $GITHUB_OUTPUT
             fi
           fi

src/ANcpLua.Agents.Hosting.BitNet/ANcpLua.Agents.Hosting.BitNet.csproj

@@ -3,6 +3,7 @@
         <RootNamespace>ANcpLua.Agents.Hosting.BitNet</RootNamespace>
         <PackageId>ANcpLua.Agents.Hosting.BitNet</PackageId>
         <Description>Alpha-channel BitNet (bitnet.cpp llama-server) hosting facades for Microsoft Agent Framework consumers. Reads the OpenAI-compatible /v1 surface exposed by bitnet.cpp and registers a keyed IChatClient, health-check, and legacy-max-tokens shim. Bundles a Roslyn source generator that auto-wires [assembly: QylBitNetEndpoint] attributes.</Description>
+        <PackageReleaseNotes>First publish to nuget.org. Pairs with ANcpLua.Agents.Testing's BitNetFixture which auto-manages Microsoft's prebuilt bitnet.cpp Docker image (digest-pinned) when BITNET_URL is unset and Docker is on PATH. Includes the LegacyMaxTokensPolicy shim for llama-server builds pre-ggml-org/llama.cpp#19831.</PackageReleaseNotes>
         <PackageReadmeFile>README.md</PackageReadmeFile>
         <PackageTags>maf;agents;microsoft-agents;bitnet;llama-cpp;local-llm;hosting;alpha</PackageTags>
         <!-- Mirrors upstream MAF + Microsoft.Extensions.AI experimental API diagnostics; keep confined to this alpha hosting package. -->