Migrate NuGet publishing from API key to Trusted Publishing

## Summary

The `release` job in `.github/workflows/ci.yml` currently authenticates to NuGet.org using a stored API key (`secrets.NUGET_KEY`). NuGet.org now supports [Trusted Publishing](https://devblogs.microsoft.com/dotnet/enhanced-security-is-here-with-the-new-trust-publishing-on-nuget-org/), which uses OpenID Connect (OIDC) tokens from GitHub Actions instead of long-lived secrets.

## Current State

```yaml
# .github/workflows/ci.yml line 89
dotnet nuget push **/*.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_KEY }} --skip-duplicate
```

## Why Change

- **No stored secrets** — OIDC tokens are short-lived and scoped to the workflow run, eliminating the risk of leaked or rotated API keys.
- **Audit trail** — NuGet.org links each publish back to the specific GitHub Actions run.
- **Reduced maintenance** — No need to rotate or manage the `NUGET_KEY` secret.

## Implementation Guide

Follow the steps in the official .NET skill:
https://github.com/dotnet/skills/blob/main/plugins/dotnet/skills/nuget-trusted-publishing/SKILL.md

At a high level:
1. **Configure Trusted Publishing on NuGet.org** — Register the GitHub repository and workflow in the NuGet.org Trusted Publishers settings for each package owned by the Brighter org.
2. **Update the `release` job** — Add `id-token: write` permission and replace the `dotnet nuget push --api-key` call with the OIDC-based flow.
3. **Remove the `NUGET_KEY` secret** — Once Trusted Publishing is verified, delete the secret from the repository settings.

## Acceptance Criteria

- [ ] Tag-triggered releases publish to NuGet.org via Trusted Publishing (no API key)
- [ ] `NUGET_KEY` secret is removed from repository settings
- [ ] Pre-release (prerelease job, GitHub Packages) publishing is unaffected