test: guard the release wiring that fails silently - #20

Trusted Publishing matches on the workflow file name, the environment and
the repository — none of which the build knows about. Rename release.yml
or the `nuget` environment and every check stays green; the next tag fails
to publish with an authentication error that never mentions the rename.
The job split has the same shape: nothing stopped a later edit from
handing the unattended verify job an id-token, or one job both the token
and repository write access.

ReleaseWiringConventionTests, ported from CodoMetis.ValueRanges and
extended: release.yml exists under that name; the publish job is gated on
`environment: nuget`; only the publish job holds id-token: write; no job
holds both id-token: write and contents: write (the boundary the release
job introduced in #17 relies on); the tag is checked against
Directory.Build.props; cyclonedx is pinned in the tool manifest; nothing
matching *publish* exists under scripts/. Job bodies are sliced by their
two-space-indented keys and every assertion matches YAML keys, not words —
the verify job's comment says "id-token" precisely to explain why it has
none.

Verified: all seven pass against main's two-job release.yml and against
the three-job shape from #17; each seeded defect — environment renamed,
verify given id-token, publish given contents: write, publish stripped of
id-token, tag check reworded, cyclonedx removed from the manifest, a
scripts/publish-nuget.sh added — fails exactly one test.
ClaudeMdConsistencyTests passes with the new table row.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>