chore(ci): adopt NuGet trusted publishing (OIDC) for releases

[Aaronontheweb]

Summary

Replaces the long-lived NUGET_KEY repo secret with NuGet trusted publishing (OIDC). Pattern lifted from netclaw-dev/skill-server's release workflow and matches Microsoft's guidance.

Workflow changes (.github/workflows/publish_nuget.yml)

• permissions: id-token: write — required for OIDC token issuance to the workflow
• environment: nuget on the publish-nuget job — links to a GitHub environment that pairs with the trusted publisher policy on nuget.org
• New step: NuGet/login@v1 with user: \${{ secrets.NUGET_USER }} — exchanges the OIDC token for a short-lived NuGet API key
• dotnet nuget push uses \${{ steps.nuget-login.outputs.NUGET_API_KEY }} instead of \${{ secrets.NUGET_KEY }}
• Now also pushes .snupkg (symbol package) and attaches it to the GitHub release alongside the .nupkg

⚠️ One-time setup required before next tag push

This PR doesn't configure the nuget.org policy or the GitHub environment — those are out-of-band manual steps the package owner must complete. Until they're in place, the next `v..` tag push will fail at the NuGet login (OIDC) step.*

On nuget.org

1. Sign in → Account → Trusted Publisher Policies → Add new policy
2. Configure:
   • Publisher: GitHub Actions
   • Repository owner: Aaronontheweb
   • Repository name: ShellSyntaxTree
   • Workflow file: publish_nuget.yml
   • Environment: nuget
   • Package owner: your nuget.org username (the one set in NUGET_USER below)
   • Optional: package-name pattern ShellSyntaxTree* (scopes the policy to this package family)

On the repo

1. Settings → Environments → New environment → name it nuget. Optional: restrict deployment to tags matching v*.*.*.
2. Settings → Secrets and variables → Actions → add repo secret NUGET_USER (your nuget.org account username — NOT an API key). The legacy NUGET_KEY secret can be deleted once trusted publishing is verified working.

TOOLING.md

Updated the "NuGet" section to describe the new flow plus a new "NuGet trusted publishing" subsection documenting the one-time setup so future contributors find the instructions in the repo.

Verification

• ✅ Workflow file YAML valid (no syntax errors)
• ⚠️ End-to-end verification only happens on the next tag push, after the nuget.org policy + nuget environment are in place
• The id-token: write permission only takes effect on tag-push runs, so this PR's own pr_validation.yml run won't exercise it (pr_validation.yml is unchanged)

Test plan

• CI passes on Test-ubuntu-latest
• CI passes on Test-windows-latest

Next

After this PR merges and the one-time nuget.org + repo-environment setup is done, push the v0.1.0-alpha tag (deliberately deferred at PR 7). publish_nuget.yml will use the OIDC flow to publish.