[dfederm]

Summary

The v3.5.12 release failed to publish because the workflow had OIDC permission but did not obtain an API key for dotnet nuget push. This adds NuGet/login@v1 to exchange the GitHub token for a short-lived NuGet.org key and passes that key to the push, without adding a long-lived secret.

Why this is safe

• Login and push run only for v* tags; build, test, NuGet.org source, and --skip-duplicate behavior are unchanged.
• The change is confined to the release workflow. No application code, GitHub Secrets, or NuGet.org policy was changed.

Validation

Check	Result
actionlint v1.7.12	Passed
YAML parse and workflow structure check	Passed: login immediately precedes push, both share the tag guard, and push uses the login output
git diff --check	Passed

Live token exchange and package publication were not tested; they require a tag-triggered release against the configured NuGet.org trusted-publisher policy.