ci(release): add NuGet release workflow with MinVer versioning

[pdevito3]

Summary

• Add .github/workflows/release.yml. It runs on a v* tag push and on workflow_dispatch, packs only QueryKit/QueryKit.csproj, and pushes to nuget.org through NuGet Trusted Publishing (OIDC via NuGet/login@v1, no long-lived API key).
• Replace the hardcoded <Version>1.14.2</Version> in QueryKit/QueryKit.csproj with MinVer (tag prefix v), so a v* tag sets the package version.

Proof

• dotnet pack at the v1.14.2 tag, with this MinVer change applied, produces QueryKit.1.14.2.nupkg.
• dotnet pack on this branch (52 commits past v1.14.2) produces QueryKit.1.14.3-alpha.0.53.nupkg, a prerelease above 1.14.2.
• The .nuspec packed at the v1.14.2 tag with MinVer is byte-for-byte identical to the .nuspec packed from the original, unmodified csproj at that same tag. No other package metadata changed.
• dotnet build --configuration Release for the full solution still succeeds.

One-time setup needed before the first release

1. On nuget.org, create a Trusted Publishing policy for owner pdevito3, repo QueryKit, workflow file release.yml.
2. In the QueryKit GitHub repo, add the NUGET_USER Actions secret, set to the nuget.org profile name (not email).

How to cut a release

1. Pick a commit on main that already passed CI.
2. Tag it: git tag -a v1.14.3 -m "v1.14.3" <commit>.
3. Push the tag: git push origin v1.14.3.

The tag push triggers the workflow, which packs and publishes QueryKit.1.14.3.nupkg. workflow_dispatch is available for a manual re-run; --skip-duplicate makes a re-push a no-op.

Out of scope

This PR does not tag a release, publish a package, run the workflow, create secrets, or change the test workflows or the README.

Test plan

• Reviewer confirms the Trusted Publishing policy and NUGET_USER secret, per the setup steps above.
• After merge, tag and push a release per the steps above, and confirm the workflow run succeeds and the package appears on nuget.org.