ci: CalVer release automation + dev/master branch flow

[seraphx2]

Ports the versioning / CI / release system from the dev-prompt project, adapted for a NuGet library. Not for release — this merges into dev so we can watch CI go green; nothing is published.

Branch model

• dev — long-lived integration branch. Feature branches, Dependabot, and contributor PRs all target it.
• master — release branch. A dev → master merge cuts exactly one release. That PR is the deliberate "ship it".

Versioning — scripts/compute-version.sh

• CalVer YYYY.(MM*100+DD).BUILD, e.g. 2026.909.1.
• Computed at release time from today's date + existing git tags (build = highest same-day tag + 1, else 1). Nothing is hand-incremented or committed.
• Passed to dotnet pack -p:Version= — no file is mutated. csproj <Version> is now a 0.0.0-dev placeholder.
• Tags stay un-prefixed to match this repo's history (2023.11.01, …); dev-prompt uses a leading v — the one intentional deviation.

Workflows

File	Trigger	Does
ci.yml	PR to master or dev	Restore + Release-build all 9 TFMs. Aggregating check job — set this as the required status check on master. Replaces build-check.yml.
ci-dev.yml	push to dev	Same build, per-commit, so a break pins to its commit.
release.yml	push to master, or manual dispatch	Compute version → dotnet pack → push to NuGet → GitHub Release (creates the tag) → Discord. Skips on [skip release] and doc-/CI-only changes. Manual draft run packs + attaches the .nupkg without pushing to NuGet. Replaces deploy.yml.
.github/actions/ci-dotnet	—	Shared composite: SDK 8 + restore + all-TFM build.

Dependabot — .github/dependabot.yml

Grouped weekly updates (one PR per ecosystem), nuget + github-actions, targeting dev. semver-major updates are ignored — those need code changes and are taken by hand (this is what keeps consumers safe: no surprise Microsoft.IdentityModel 7/8 or Extensions.* 9 landing unreviewed).

Also

• Deleted GetBuildVersion.psm1 (dead Azure-DevOps-era snippet, wired to nothing) and the Scc* "SAK" source-control junk PropertyGroup.
• .gitattributes gains *.sh / *.yml → eol=lf so the shell script and workflows stay LF on Linux runners.

Manual steps on GitHub (can't be done from a PR)

1. After this merges to dev: Settings → default branch → dev.
2. Branch protection on master: require a PR, require the check status.
3. Confirm secrets exist (all already referenced by the old deploy.yml): NUGET_API_KEY, DISCORD_WEBHOOK_URL, DISCORD_TEST_WEBHOOK_URL.
4. Optional: delete the stale develop branch.

Not in scope

Dependency modernization (net8/net9, Microsoft.IdentityModel 6→8, dropping System.Net.Http) is the next PR into dev. dev-prompt's repo.yml (self-hosted apt/rpm/pacman repo) has no analogue — nuget.org is the distribution channel.

🤖 Generated with Claude Code