Add CI publish job for NuGet packages to CodeArtifact

[Faisal-Bahoo]

Summary

• Extends the existing GitHub Actions CI workflow with a publish job
• On push to main (after tests pass), authenticates via OIDC to the staging account (366391106850) and pushes NuGet packages to CodeArtifact mindtouch-deki/cxe-nuget
• Includes a version-exists check: if the version in Scripts/set-lash-version.sh is already published, the job skips with a warning annotation — prevents duplicate publishes and makes it clear when a version bump is needed
• Removes --skip-duplicate in favor of failing loudly if an unexpected conflict occurs

Prerequisites (completed)

• IAM role github-lambdasharp-publish created in account 366391106850 with OIDC trust for repo:MindTouch/LambdaSharpTool:ref:refs/heads/main
• Role has CodeArtifact publish permissions scoped to cxe-nuget repository only
• Repo secret AWS_ROLE_ARN set on MindTouch/LambdaSharpTool

How it works

1. Tests run on all PRs and pushes (unchanged)
2. publish job only triggers on push to main
3. Checks CodeArtifact for existing version → skips if already published
4. Builds + packs all SDK libraries and LambdaSharp.Tool
5. Pushes .nupkg files to CodeArtifact
6. Verifies the package version is queryable

Version workflow

• Code-only merges (no version bump): publish job passes with a warning "version already exists"
• Release merges (version bumped in Scripts/set-lash-version.sh): publishes new packages

Test plan

• Merge this PR to main — first run should detect 0.8.5.1 already exists and skip with warning
• Bump version to 0.8.5.2 in a follow-up PR — merge should trigger actual publish
• Verify dotnet tool install LambdaSharp.Tool --version 0.8.5.2 works from CodeArtifact

Context

Step 1 of the post-merge plan from PR #4 (Deki #38135). Next: update CD stage to re-add the LambdaSharp deploy step.

🤖 Generated with Claude Code