ci: add manual NuGet trusted publishing

[svetstoykov]

Summary

• add manually triggered, tag-based publishing for one selected NuGet package
• validate, test, pack, and transfer artifacts before environment-gated OIDC publication
• replace API-key release guidance with Trusted Publishing runbook

Test Plan

• dotnet restore TokenGuard.sln --nologo
• dotnet build TokenGuard.sln --configuration Release --no-restore --nologo
• dotnet test TokenGuard.sln --configuration Release --no-build --nologo (281 passed)
• independently pack all three NuGet projects with matching symbol packages
• git diff --check
• confirm release-validation.yml unchanged from 73142de