ci: harden release workflow

[solrevdev]

Summary

• default the workflow token to read-only and isolate tag writes in a dependent master-only job
• serialize master releases while allowing refreshed pull requests to cancel stale validation
• verify the exact package before native NuGet publication and gate tagging on a positive publish output
• validate existing tag commit and csproj provenance before accepting a retry
• manually bump the package to 1.4.2 for this release
• synchronize and correct AGENTS.md and CLAUDE.md repository guidance

Release ordering

Build and integration tests → pack → exact .nupkg verification → dotnet nuget push --skip-duplicate → provenance-checked lightweight tag.

Risks

• Splitting tag creation into a dependent job changes permission boundaries and retry behavior.
• Incorrect if/needs logic could skip tagging after a successful publish.
• Overly broad cancellation could interrupt a master release; concurrency therefore cancels only pull-request runs.
• Accepting an existing tag without provenance checks could hide a version collision; retries now require the expected commit and csproj version.

Validation

• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/ci.yml (actionlint 1.7.12)
• dotnet build solrevdev.seedfolder.sln --configuration Release (0 warnings, 0 errors)
• ./tests/integration-test.sh (all cases passed)
• dotnet pack solrevdev.seedfolder.sln -c Release --no-build --include-source --include-symbols (1.4.2 package and symbols package created)
• git diff --check

Release plan

After PR validation, merge to master, monitor NuGet publication and tag creation, inspect full raw logs for runtime/deprecation signals, and verify NuGet 1.4.2 plus local/remote master synchronization.