Automate NuGet and GitHub releases

[rantri]

What changed

• add a manually triggered release workflow that validates the requested version, runs the full release suite, creates .nupkg and .snupkg artifacts, publishes through NuGet trusted publishing, and publishes a matching GitHub release and tag
• harden CI with pinned action revisions, explicit step names, and concurrency cancellation
• add public package project metadata and portable symbol packages
• extract GitHub release notes from the matching changelog section
• document the one-time trusted-publishing setup, release recovery behavior, and the exact maintainer procedure
• add validation and contract coverage for the new package metadata

Why

SharedMemoryStore has a published NuGet package but did not yet have a repeatable GitHub Release/NuGet publication workflow. This makes releases deliberate but automated and avoids storing a long-lived NuGet API key.

Impact

After this is merged to main, a maintainer can publish version 1.0.1 from Actions → Release by entering 1.0.1. The workflow owns package creation, NuGet publication, the v1.0.1 tag, and the GitHub release.

The GitHub release environment is restricted to main, private vulnerability reporting is enabled, and the matching NuGet trusted-publishing policy has been created.

Validation

• pwsh ./scripts/validate-cross-platform.ps1 -SkipDocker
• 43 contract, 62 unit, and 48 integration tests passed
• all host samples and clean packed-package consumption passed
• documentation validation passed
• dotnet format --verify-no-changes passed
• both workflow files passed YAML lint and actionlint
• generated .nupkg and .snupkg metadata and contents were inspected