Refresh CI and NuGet publishing

[Kralizek]

Summary

Refreshes the repository's build and NuGet publishing infrastructure without changing the library APIs or target frameworks.

• simplifies CI to restore, build, and test using the pinned SDK from global.json
• separates release publishing from ordinary CI
• uses the GitHub Release tag as the package version for releases
• replaces the long-lived NuGet API key with NuGet Trusted Publishing (nuget/login + OIDC)
• publishes release packages to both NuGet.org and GitHub Packages
• uploads .nupkg / .snupkg files as workflow artifacts and GitHub Release assets
• removes the legacy AppVeyor configuration

Manual runs of the publish workflow build preview packages but do not publish them.

No package/library refresh is included in this PR.