Decisions left after the project-template v0.61.2 and NCode Review v1.1.2 upgrade #14

The upgrade merged in #12. These items need a maintainer's decision or one-time setup.

• AssemblyVersion. The template's ProjectTemplatePinAssemblyVersion target (build/ProjectTemplate.props, ADR-0136) sets AssemblyVersion to <major>.0.0.0 when the project sets none, and this repo sets none. v1.0.1 shipped as 1.0.1.0, so the next 1.x release would carry 1.0.0.0, lower than that. Either set <AssemblyVersion> explicitly in Directory.Build.props or accept the change (it is already noted in CHANGELOG.md under Changed).
• Auto-merge exception. .github/workflows/code-review-auto-merge.yml enables auto-merge on Dependabot pull requests whose only change is the NCode Review pin (ADR-0006's exception). It was kept and the exception is recorded under Conventions in AGENTS.md. Confirm, or delete both.
• Publishing. main.yml still publishes on release with the NUGET_APIKEY secret; the template's publish.yml was deleted so a release does not publish twice, and SECURITY.md describes the main.yml path. To move to trusted publishing: restore publish.yml (its pack job also needs the .NET 6.0.x setup step, as ci.yml has), do its one-time nuget.org, nuget environment and NUGET_USER setup, then drop the main.yml publish job and the secret.
• main.yml is also named "CI", like the template's ci.yml, and duplicates its build. The README badge points at main.yml. Retire one, and point the badge at the survivor.
• Turn on private vulnerability reporting, then remove the hidden maintainer reminder comment from SECURITY.md.
• Changelog backfill for v1.0.0 and v1.0.1: /plan-migration Backfill CHANGELOG.md from the releases v1.0.0..v1.0.1.