Match NuGet trusted publishing release environment

[magiccodingman]

Summary

Aligns the GitHub Actions OIDC identity with the existing NuGet trusted-publishing policy.

• declares environment: release on the package-publishing job
• documents the distinction between the protected release branch and the GitHub Actions release environment
• retains the existing id-token: write permission, workflow filename, trusted-publishing username, validation gates, and retry-safe 2.0.3 version calculation

Root cause

The NuGet policy GitHub-IndexedDB requires the environment claim release. The workflow ran only on pushes to the release branch, but a branch trigger does not populate GitHub's OIDC environment claim. NuGet therefore received an empty environment and rejected the token exchange with HTTP 401:

Environment mismatch for policy 'GitHub-IndexedDB': expected 'release', actual ''

The job-level environment declaration makes the token claim match the policy:

publish:
  environment: release

Repository configuration

A GitHub Actions environment named release has now been created for this repository. Its deployment branch policy allows protected branches; the publishing workflow itself remains restricted to pushes to the protected release branch.

Verification

• the workflow YAML parses successfully
• an explicit assertion confirms jobs.publish.environment == "release"
• git diff --check passes
• the GitHub environment API reports release with its protected-branches deployment policy active
• hosted required matrix: all five checks passed
• no runtime code, package contents, package version, public API, or Dexie asset changed

After merge

Merge master into release again. The release workflow will re-run all five required validation checks, calculate 2.0.3, and request a NuGet token carrying the required release environment claim.