Avoid dirtying NuGet lock files in trimmed publish tests

[Widthdom]

Summary

• Redirect RID-specific trimmed test publishes to a temporary NuGetLockFilePath under the publish intermediate output.
• Apply the same lock-file isolation to both trimmed publish test helpers.
• Document the test helper convention and add a bilingual changelog fragment.

Validation

• Reproduced the pre-fix dirty state with dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 --filter "FullyQualifiedName~QueryCommandRunnerTests.RunPublishedTrimmedCli_SerializesQueryJsonAndErrorJson" -p:UseSharedCompilation=false, which added net8.0/osx-arm64 to src/CodeIndex/packages.lock.json.
• dotnet restore CodeIndex.sln --locked-mode
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format whitespace CodeIndex.sln --verify-no-changes --no-restore --verbosity minimal
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 --filter "FullyQualifiedName~QueryCommandRunnerTests.RunPublishedTrimmedCli_SerializesQueryJsonAndErrorJson" -p:UseSharedCompilation=false
• Verified git diff -- src/CodeIndex/packages.lock.json stayed empty after the fixed targeted test.
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

Documentation / Changelog

• Updated TESTING_GUIDE.md.
• Added changelog.d/unreleased/2918.fixed.md.

Review

• Codex adversarial review: no actionable regressions found.

Follow-up Candidates

None.

Fixes #2918