Adopt OIDC trusted publishing for NuGet; reduce long-lived credentials

[piers-sinclair]

Problem

NUGET_API_KEY is a long-lived API key, and WINGET_TOKEN / HOMEBREW_TAP_TOKEN are long-lived PATs. Long-lived bearer secrets are higher-risk if leaked, and require manual rotation.

Fix

• Use NuGet trusted publishing (OIDC) to replace NUGET_API_KEY with short-lived, workflow-scoped tokens.
• Where feasible, replace the Homebrew tap PAT with a GitHub App installation token scoped to the tap repo only.
• Document the rotation cadence for anything that must stay a PAT.

Tokens are already minimally scoped (good); this removes the durable-secret risk entirely.

Priority: Medium