Build required cross-browser and contract test gates

[magiccodingman]

Summary

This builds a stronger verification system around Magic IndexedDB and makes it part of the normal pull-request and release paths.

• adds deterministic .NET contract tests for the public API, expression translation, schema construction/validation, serialization shapes, chunked-stream lifecycle, and the test validator itself
• expands browser coverage from 101 to 113 scenarios, including range CRUD, database lifecycle/isolation, compound keys, exact ordering, pagination, multi-chunk Unicode streaming, cancellation, concurrent streams, constraints, and storage estimates
• runs the complete browser suite in Chromium, Firefox, Linux WebKit, and macOS WebKit
• runs core and browser validation for every PR, again after pushes to master, and as blocking prerequisites inside publish-nuget.yml before a release push can publish
• verifies the produced NuGet package contains its assembly, README, license, icon, and static web assets
• documents local commands, API-baseline updates, CI expectations, and the precise WebKit-versus-real-Safari limitation

Regressions the stronger tests exposed and fixed

The new assertions found real behavior that the earlier count/key-only comparisons could not detect:

• ordered queries could lose their requested order when final records were fetched through Dexie anyOf() batches
• TakeLast selected the correct records but returned them reversed in both indexed and cursor paths
• pure OrderBy/OrderByDescending cursor queries could bypass metadata sorting when no pagination operator was present
• bulk delete expected PascalCase key DTO fields even though current interop can send camelCase; it now accepts both shapes
• Firefox rejects ISO timestamps whose T separator was lowercased by generic case-insensitive string normalization; normalization is now limited to actual string predicates, and date handling accepts valid values across browser realms
• WebKit builds without navigator.storage.estimate() now return a safe zero estimate instead of throwing
• the Release browser harness previously launched the web project through a fragile relative dotnet run; it now launches the exact built DLL on an ephemeral localhost port and reports server stderr on startup failure
• redirected test-server output is continuously drained and bounded, preventing a full stdout pipe from blocking a long browser run on macOS
• the browser harness no longer depends on the optional indexedDB.databases() enumeration API, whose promise can remain unsettled in Playwright's macOS WebKit build; registration and cleanup are verified through standard open() and deleteDatabase() requests instead
• macOS WebKit runs on GitHub's supported macos-15 image; Playwright reports its macos-14 WebKit binary as frozen and no longer updated

Compatibility boundaries

• no public .NET API signatures changed; the new reviewed public-API snapshot locks the current surface
• no package version was changed
• Dexie was not upgraded and IndexedDB 3.0 work is intentionally out of scope
• existing unordered test comparisons remain unordered by default; only tests that promise ordering opt into positional validation
• macOS WebKit is meaningful Apple-engine coverage, but it is not branded Safari or a real iPhone/iPad. Real Safari/iOS devices remain a future external-device CI addition.

Verification

Local final results:

• .NET unit and contract tests: 46/46 passed
• Chromium integration: 113/113 passed
• Firefox integration: 113/113 passed
• WebKit integration: 113/113 passed
• focused Firefox date-component matrix: 25/25 passed
• NuGet pack and content verification: passed
• workflow YAML parse validation: passed
• hosted required matrix: all five checks passed, including all four macOS WebKit shards

The existing master and release rulesets now both require all five checks; the previously disabled release ruleset was activated without changing its three-review policy.