ci: set NuGet publishing environment

[ling921]

Summary

• associate the NuGet publishing job with the GitHub production environment
• include the expected environment claim in the GitHub OIDC token
• fix NuGet Trusted Publishing policy mismatch: expected production, actual empty

Validation

• git diff --check
• confirmed NuGet Trusted Publishing environment requirements