Ship Reactor as a consumable package (NuGet + CLI)

@philnach is already working on this.

Since Jun 8, 2026.

## Problem

Today, using Reactor in an app means cloning `microsoft/reactor3` and taking a `` to `src/Reactor/Reactor.csproj`. Every consumer has to enlist in our source tree and keep it in sync. This is a hard blocker for:

- **Evaluators** who want to spend 10 minutes kicking the tires, not set up an enlistment.
- **Internal partner teams** who need a stable dependency they can pin, not a moving branch.
- **NDA external partners** (next ~2 weeks) and the **public launch** (next ~4–6 weeks), neither of which can reasonably ship with "clone our repo" as the install story.

We also have no CI story for producing versioned artifacts. `.github/workflows/ci.yml` runs unit tests and stops there — nothing packs, nothing publishes, nothing signs.

## What we need

A consumer should be able to write this and be done:

```xml

```

…and get the framework, analyzers, and source generator — with `mur` (the CLI) installable via a one-liner, and a pipeline that produces a versioned, installable artifact on every PR so reviewers can test real installs.

## Plan

The full design is in the merged spec:
**[docs/specs/022-packaging-and-distribution.md](../blob/main/docs/specs/022-packaging-and-distribution.md)**

Highlights:
- `Microsoft.UI.Reactor` NuGet bundles `Reactor.Analyzers` and `Reactor.Localization.Generator` inside the same `.nupkg`.
- `mur` ships as per-RID self-contained zips on GitHub Releases (not a `dotnet tool` — WinUI TFM makes that brittle).
- Per-PR prerelease builds via MinVer (`0.1.0-pr..`).
- Three-phase rollout: **P1 internal Azure Artifacts → P2 NDA external via GitHub Packages + ESRP → P3 public NuGet.org**. Same pipeline, different publish destinations.
- ESRP signing onboarding is a 1–2 week gate and needs to start in parallel with P1.

## Open questions blocking P1

See [§13 of the spec](../blob/main/docs/spec/022-packaging-and-distribution.md#13-open-questions) — license (README still says \"Microsoft Internal\"), internal feed ownership, whether the internal feed enforces signing, package ID stability vs. spec 018, Monaco asset size, WinUI SDK pin strategy, and the `mur` install-script trust boundary.

## Next step

Answer the open questions, then kick off the P1 implementation track from [§14](../blob/main/docs/spec/022-packaging-and-distribution.md#14-implementation-phases).