fix(nuget): clear inherited sources so restore is deterministic (#214) (#240)

The root nuget.config previously relied on additive merging with the
user-level %APPDATA%\NuGet\NuGet.Config. On machines that have any
authenticated <packageSource> entries at the user level (common in
enterprise developer setups), `dotnet restore` fans every package out
against every inherited feed, fails authentication, retries, and can
hang 14+ minutes producing hundreds of NU1301 errors before completing
— the very first command a new contributor runs.

Add <clear /> inside <packageSources> so only reactor-local and
nuget.org are used. Also clear <disabledPackageSources> so a user-level
disabled entry can't silently turn one of them off. This matches the
convention already used by the repo's own test-fixture NuGet.configs
(tests/startup_perf/BlankRNW, tests/stress_perf_rn/*).

Verified `dotnet nuget list source` shows only the two intended sources
and a fresh restore of src/Reactor.Cli completes cleanly.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: codemonkeychris

nuget.config

@@ -6,11 +6,18 @@
        scaffolded apps under this repo use #:package Microsoft.UI.Reactor and
        resolve through this feed.
 
-       nuget.org remains the source for everything else (Microsoft.WindowsAppSDK
-       and friends). It's added explicitly here so this file is self-contained
-       — global sources still apply additively. -->
+       nuget.org is the only public source we need (Microsoft.WindowsAppSDK and
+       friends resolve from there). We <clear /> first so user-level sources
+       from %APPDATA%\NuGet\NuGet.Config (often authenticated enterprise feeds)
+       don't get merged in. Without this, `dotnet restore` on a fresh clone
+       fans every package out against every inherited feed and can hang for
+       minutes on auth failures — see issue #214. -->
   <packageSources>
+    <clear />
     <add key="reactor-local" value="local-nupkgs" />
     <add key="nuget.org"     value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
   </packageSources>
+  <disabledPackageSources>
+    <clear />
+  </disabledPackageSources>
 </configuration>