ci: harden release pipeline for bare SemVer tags

[AGiorgetti]

Summary

• Gate publishing on exact bare stable/prerelease SemVer tag and GitVersion matches.
• Pack once, validate package/API/consumer/trimming/AOT/content contracts, and hand off exact six artifacts with checksums/provenance.
• Separate dry-run verification from approval-gated NuGet publishing; remove duplicate suppression.
• Make test discovery explicit, remove inactive workflow copies, and synchronize release docs/checklist.
• Keep the generator package analyzer-only without Roslyn runtime assets.

Validation

• dotnet build Mammoth.LiteMapper.sln -c Release --no-restore: passed, 0 warnings/errors.
• ReleaseQualityContractTests: 14/14 passed.
• Milestone14PackagingAndAotTests: 24 passed, 1 expected Windows linker-prerequisite skip.
• dotnet test Mammoth.LiteMapper.sln -c Release --no-build --no-restore: 649 passed, 1 expected Windows linker-prerequisite skip.
• All six local packages packed and package-content checks passed.
• YAML parse and git diff --check passed.
• dotnet tool restore and package-level apicompat were blocked by local NuGet SSL access; no NuGet publication was attempted.

Refs #17