Add NuGet-only release recovery

[peters]

Purpose

• add an explicit NuGet-only mode for recovering an existing published release
• reuse the release's immutable package without rebuilding platform artifacts
• allow GitHub Packages publication to proceed when NuGet.org rejects its credential

Behavior impact

Normal release events and full recovery dispatches still require the complete platform artifact matrix before package publication. An explicit nuget recovery dispatch validates the published release and immutable tag, reuses the exact attached package, and publishes only the NuGet feeds. Cargo publication and release-asset collection are skipped in that mode.

The package job respects cancellation, and both feeds retain duplicate-safe publication for idempotent recovery.

Validation

• ./scripts/sync-surge-core-vendor.sh --check
• ./scripts/check-version-sync.sh
• cargo fmt --all -- --check
• RUSTFLAGS="-D warnings" cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo clippy --workspace --lib --bins --examples -- -D warnings -D clippy::unwrap_used -D clippy::expect_used
• cargo clippy --workspace --all-targets --all-features -- -D warnings -W clippy::pedantic
• dotnet format dotnet/Surge.slnx --verify-no-changes
• dotnet test dotnet/Surge.slnx --configuration Release
• actionlint .github/workflows/release.yml
• YAML parse and release dependency assertions

Migration

No application migration is required. Existing manual recovery calls default to full; select nuget only when retrying the package feeds for an already published release.