Add trusted publishing for Python and .NET

[Jason-Doyle]

Summary

• add protected OIDC release workflows for worldcut on PyPI and WorldCut/WorldCut.Tool on NuGet.org
• bump both ports to 0.1.1 without changing protocol or engine semantics
• require annotated protected tags, exact main CI, owner-approved environments, isolated package consumption, registry verification, and non-latest language-specific GitHub releases
• make publication rerunnable after partial failures and verify NuGet repository signatures/content rather than comparing post-signing bytes

Quality gate

• Python: Ruff, strict mypy, 54 tests, reproducible wheel/sdist, Twine and wheel-content checks
• .NET: locked restore, zero-warning build, 548 tests on net8/net10, package allowlists and isolated library/tool consumers
• 583-case four-language differential suite
• NuGet signature/content verifier tested on Windows and Linux against a real repository-signed package
• actionlint and root release checks

External activation

The GitHub pypi and nuget environments already require @Jason-Doyle approval, and protected port tags are enforced. Before tags are created, the registry-side trusted-publisher policies documented in docs/PORT_RELEASES.md must be configured; NuGet also needs the environment variable NUGET_USER.