ci: modernize NuGet publishing workflow

[solrevdev]

Summary

• move checkout and setup-dotnet to established Node 24-compatible v5 releases
• replace the Node 20 softprops release action with native gh release create
• add read-only pull-request build/package validation
• publish the NuGet package before atomically pushing the version commit and tag
• add concurrency, race checks, exact package verification, and retry-safe tag/release handling
• narrow default permissions to contents: read and grant contents: write only to publishing

Why

The existing workflow used three Node 20 actions and pushed its version commit and tag before build, pack, and NuGet publication had succeeded. A failure could therefore leave repository release markers for a package that was never published.

Validation

• actionlint v1.7.7
• dotnet restore src/Ytx
• dotnet build src/Ytx --configuration Release --no-restore
• dotnet pack src/Ytx --configuration Release --no-build
• verified nupkg/solrevdev.ytx.1.0.3.nupkg contents

The repository has no test project, so there is no separate local test suite to run.