Publish to NuGet with trusted publishing only

[capjan]

Summary

Trusted publishing works: v12.2.0 was published with it (OIDC login, run 36209736579). The fallback to the NUGET_API_KEY secret is not needed any more.

Changes (nuget_deploy.yml only)

• The push uses only the short-lived key of the login step, no longer || secrets.NUGET_API_KEY.
• The login step does not continue-on-error any more. If the login fails, the job fails there, before anything is pushed, instead of pushing with an empty or outdated key and failing later with a less clear error.

Nothing else in .github references a secret, and the documentation does not mention it.

After merging

The repository secret NUGET_API_KEY (last set 2022) is not used any more and can be deleted in the repository settings. This does not have to wait for the merge: the current workflow only uses it as a fallback.

Verification

• The YAML is valid; the login step has no continue-on-error, the job keeps id-token: write
• The release job was run locally step by step (test, pack, version check against the tag) before 12.2.0 was published
• The change only takes effect with the next release, so it is not exercised by this PR's CI. The first release after the merge is its real test; if the login fails there, the job stops before the push and can be re-run.