ci: nuget trusted publishing

Author: ascott18

.github/workflows/part-publish.yml

@@ -39,8 +39,14 @@ jobs:
       - name: Download all workflow run artifacts
         uses: actions/download-artifact@v5
 
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ascott18
+
       - name: dotnet nuget push
-        run: dotnet nuget push "**/*.nupkg" -s https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_TOKEN }}
+        run: dotnet nuget push "**/*.nupkg" -s https://api.nuget.org/v3/index.json --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
 
   docs:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -65,5 +65,11 @@ jobs:
         with:
           name: template-packages
 
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ascott18
+
       - name: dotnet nuget push
-        run: dotnet nuget push "**/*.nupkg" -s https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_TOKEN }}
+        run: dotnet nuget push "**/*.nupkg" -s https://api.nuget.org/v3/index.json --api-key ${{ steps.login.outputs.NUGET_API_KEY }}