Tighten release and CI supply-chain controls

[Widthdom]

Summary

• Remove git from the published runtime container image and request provenance/SBOM attestations for GHCR image builds.
• Restore NuGet package caches only from exact lockfile-derived keys in build and release workflows.
• Emit reason-coded Windows Defender exclusion audit records to CI logs and job summaries before exclusions are applied.

Validation

• dotnet run --project tools/CodeIndex.Changelog -- check
• git diff --check origin/main..HEAD
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/dotnet.yml"); YAML.load_file(".github/workflows/release.yml"); puts "yaml ok"'
• Mocked pwsh execution of the Defender exclusion audit logic
• dotnet build CodeIndex.sln -p:UseSharedCompilation=false after each issue commit
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json

dotnet test CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-restore --nologo was also run, but the local validation failed on existing/out-of-scope issues tracked by #3571 and #3572.

Documentation And Changelog

• Updated DISTRIBUTION.md and DEVELOPER_GUIDE.md for the GHCR image, runtime git policy, attestation checks, and exact-key NuGet cache policy.
• Added changelog fragments:
  • changelog.d/unreleased/3495.security.md
  • changelog.d/unreleased/3496.security.md
  • changelog.d/unreleased/3497.security.md

Follow-Up References

• Trimmed publish test fails when ILLink 10.0.8 requires unavailable .NET 10.0.8 runtime #3571
• GitHelper timeout test now fails during commit validation #3572

Fixes #3495
Fixes #3496
Fixes #3497