Fix publish workflow: use pwsh for glob expansion and dotnet nuget for cloud HSM signing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: bobbyg603

.github/workflows/publish.yml

@@ -56,12 +56,12 @@ jobs:
           SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
 
       - name: Sign NuGet package
-        run: nuget sign ./nupkg/*.nupkg -Timestamper http://timestamp.digicert.com -CertificateFingerprint ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} -HashAlgorithm SHA256 -Verbosity detailed -Overwrite
-        shell: cmd
+        run: Get-ChildItem ./nupkg/*.nupkg | ForEach-Object { dotnet nuget sign $_.FullName --timestamper http://timestamp.digicert.com --certificate-fingerprint ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} --hash-algorithm SHA256 --verbosity detailed --overwrite }
+        shell: pwsh
 
       - name: Verify signature
-        run: nuget verify -All ./nupkg/*.nupkg
-        shell: cmd
+        run: Get-ChildItem ./nupkg/*.nupkg | ForEach-Object { dotnet nuget verify --all $_.FullName }
+        shell: pwsh
 
       - name: Push to NuGet
         run: dotnet nuget push ./nupkg/*.nupkg --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate