Harden release workflow security

[Widthdom]

Summary

• Validate release tags in a read-only preflight job before privileged release work runs.
• Scope release workflow permissions, add bounded runtimes/concurrency, and pin release/mutation workflow actions by commit SHA.
• Move NuGet publishing to trusted publishing with package attestations, harden Homebrew tap credentials and checksum sourcing, and use private temporary response files for NuGet preflight headers.

Validation

• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release -p:UseSharedCompilation=false --no-build --filter FullyQualifiedName~ReleaseWorkflowTests
• Codex adversarial review: No blocking/actionable issues found.

Full solution test was attempted but hit an unrelated local SDK/runtime mismatch in RunPublishedTrimmedCli_SerializesQueryJsonAndErrorJson: ILLink 10.0.8 requires Microsoft.NETCore.App 10.0.8-servicing.26229.119, while this machine has 8.0.19, 9.0.5, 9.0.6, and 10.0.0.

Changelog

• changelog.d/unreleased/3485.security.md
• changelog.d/unreleased/3486.security.md
• changelog.d/unreleased/3487.security.md
• changelog.d/unreleased/3489.security.md
• changelog.d/unreleased/3490.security.md
• changelog.d/unreleased/3491.security.md
• changelog.d/unreleased/3508.security.md

Issues

Fixes #3485
Fixes #3486
Fixes #3487
Fixes #3489
Fixes #3490
Fixes #3491
Fixes #3508

Notes

No target issue had an existing work-started comment when checked, so none were excluded.