Fix clean NuGet packaging and retry-safe versioning

[magiccodingman]

Summary

Fixes the clean-run NuGet packaging failure from release workflow run 1 and prevents the failed attempt from skipping version 2.0.3.

• makes validation and publishing use one shared packaging command
• forces dotnet pack to perform the build required to generate Razor static-web-assets manifests
• runs package validation before the unit-test build so cached bin/obj output cannot hide this regression
• selects the next patch from versions actually published on NuGet instead of GITHUB_RUN_NUMBER
• adds deterministic tests for version selection, source-version floors, release-line isolation, prerelease exclusion, and invalid input
• documents the clean-package and retry-safe version behavior

Root cause

Magic.IndexedDb.csproj enables GeneratePackageOnBuild. NuGet's pack targets therefore omit their normal build dependency to avoid a build/pack cycle. The publish job restored the project and called dotnet pack on a fresh runner without overriding that property, so the Razor SDK tried to package obj/Release/net10.0/staticwebassets.build.json before any build had generated it.

Core validation did not fail because its package command already supplied GeneratePackageOnBuild=false, and it ran after unit tests had populated Release intermediates. The publish job used a separate runner and a slightly different command. Both paths now call .github/scripts/pack-nuget.sh, and the package smoke test deliberately runs before unit tests.

Version behavior

The failed release was workflow run 1, so the former source patch + GITHUB_RUN_NUMBER calculation would turn the next push into 2.0.4 even though 2.0.3 was never published.

The new calculation reads the checked-in stable version as the intended major/minor release line and a patch floor, validates NuGet's official package-version index, and chooses one patch above the newest matching published version or source floor. Consequently:

• current source: 2.0.2
• current NuGet release: 2.0.2
• next release result: 2.0.3
• a failed run or rerun does not consume a version
• after 2.0.3 exists, the following release resolves to 2.0.4
• an unavailable or malformed NuGet version index fails safely instead of guessing

Verification

• reproduced the original manifest failure from a clean copy of the release commit
• copied this branch without any bin, obj, or artifact directories and restored from scratch
• clean shared pack command produced Magic.IndexedDb.2.0.3.nupkg
• generated nuspec reports version 2.0.3
• package contains the .NET 10 assembly, static web assets, README, license, and icon
• live NuGet version index resolves the current release to 2.0.3
• package-version regression tests pass
• .NET unit and contract tests: 46/46 passed
• workflow YAML parsing and git diff --check pass
• hosted required matrix: all five checks passed, including the clean pre-test package build and all four browser engines

After merge

Merge master into the protected release branch again. The release workflow will repeat all required core and browser gates, then build and publish 2.0.3 through trusted publishing.

No runtime code, public API, Dexie asset, or checked-in package version was changed.