Move the release workflow to NuGet Trusted Publishing #59

Summary

release.yml pushes to nuget.org with a long-lived NUGET_API_KEY secret. ShellDocs and ShellUI Native already use NuGet Trusted Publishing (OIDC), which needs no stored key.

Steps

1. Copy ShellDocs' release job: environment: release, permissions: id-token: write, NuGet/login@v1 with secrets.NUGET_USER, push with the step's NUGET_API_KEY output. Copy its docs/RELEASING.md too.
2. One-time setup: GitHub environment release, secret NUGET_USER (the nuget.org profile name), and a nuget.org Trusted Publishing policy (owner shellui-dev, repo shellui, workflow release.yml, environment release).
3. Delete the NUGET_API_KEY secret and revoke the key on nuget.org.