Fix NuGet publish workflow failing on invalid/expired API key

[Copilot]

The build job fails at the NuGet push step with a 403 when NUGET_API_KEY is invalid, expired, or unset — causing the entire workflow to fail even though the build and pack steps succeed.

Changes

• Guard push step — added if: ${{ secrets.NUGET_API_KEY }} so the step is skipped (rather than erroring) when the secret is absent or empty
• Use env var for API key — replaced direct secret interpolation in shell args with env: NUGET_API_KEY + $env:NUGET_API_KEY, avoiding secret exposure in process listings
• Add --skip-duplicate — prevents hard failure when pushing a version that already exists on nuget.org

- name: Push NuGet package
  if: ${{ secrets.NUGET_API_KEY }}
  env:
    NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
  run: |
    $version = "${{ github.ref_name }}" -replace '^v', ''
    $pkg = Get-ChildItem -Path ./nupkgs -Filter "*$version.nupkg" | Select-Object -First 1
    dotnet nuget push $pkg.FullName --api-key $env:NUGET_API_KEY --source https://api.nuget.org/v3/index.json --skip-duplicate

The NUGET_API_KEY repository secret needs to be renewed in Settings → Secrets → Actions for publishing to resume.