ci: make the NuGet publish actually work, via Trusted Publishing

[phmatray]

This started as a credential migration and turned into a repair. The publish job held a live NUGET_API_KEY while being incapable of publishing anything.

gh run list --workflow=publish-to-nuget.yml returns nothing — this workflow has never run once, so none of the following ever surfaced:

Fault	Consequence
It never packed	The job checked out, computed a version, installed the SDK, then pushed packages that did not exist. build/test run on separate runners and nothing carried their output over.
nuget push	The nuget.exe CLI, which is not present on ubuntu-latest.
**\*.nupkg	A Windows-shaped glob.
BUILD_VERSION unused	Computed from the tag, then discarded — any release would have shipped the literal <Version>0.5.0</Version> from Directory.Build.props.
Import-Module .\build\…	Backslash path, on a Linux runner.

What it does now

Packs both packable projects (Atypical.VirtualFileSystem, Atypical.VirtualFileSystem.GitHub) with -p:Version=$BUILD_VERSION so the tag actually governs the version, pushes with dotnet nuget push, and authorizes through Trusted Publishing — GitHub's OIDC token exchanged for a key valid ~1 hour, no long-lived secret stored. The only remaining secret is NUGET_USER, the nuget.org profile name.

Please review this one more carefully than its siblings

The other six repos in this sweep were credential swaps on working pipelines. This one changes behaviour on a path that has never executed, which means CI passing here proves less than usual — the first real tag is the first genuine test. I would rather you knew that than discover it at release time.

Required before the first release

1. Register a Trusted Publishing policy on nuget.org covering both ids, naming Atypical-Consulting/VirtualFileSystem and publish-to-nuget.yml.
2. Set the NUGET_USER secret.
3. Tag, confirm both packages appear at the tag's version, then delete NUGET_API_KEY.