Automate NuGet package publishing

[shanebweaver]

Summary

• add a publish job after the existing build, test, and pack job
• publish only for successful pushes to main
• use NuGet trusted publishing with GitHub OIDC and a short-lived API key
• validate the two expected CaptureKit packages before pushing
• treat already-published versions as a successful no-op

Why

CaptureKit packages are currently produced as workflow artifacts but must be published to nuget.org manually. CaptureTool and Dependabot need those package versions to be available from nuget.org, so releases should publish automatically after they merge to main.

Impact

Pull requests continue to build and validate packages without publishing. A successful merge to main publishes CaptureKit.Abstractions and CaptureKit.Windows; merges without a version bump exit cleanly because duplicate versions are skipped.

Required setup before merge

Create a nuget.org trusted-publishing policy with:

• repository owner: shanebweaver
• repository: CaptureKit
• workflow file: ci.yml
• environment: nuget.org

No long-lived NuGet API-key secret is required.

Validation

• git diff --check
• dry-run package selection confirmed CaptureKit.Abstractions is processed before CaptureKit.Windows
• verified the workflow expects exactly the two packages produced by build.ps1