build: automate releases and stable-only public API promotion

[dombrovsky]

Summary

• centralize PublicApiAnalyzers for packable projects in Directory.Build.targets
• add and seed PublicAPI baselines for packable extension packages
• add repository-owned automation scripts under build/ for artifact validation and baseline promotion
• extend publish workflow to validate artifacts, publish nupkg/snupkg, create or verify GitHub releases, and open baseline-promotion PRs
• gate unshipped -> shipped promotion to stable releases only (skip for prerelease versions)

Validation

• pwsh -NoProfile -File ./build/tests/Test-ReleaseAutomation.ps1
• dotnet build TaskFlow.sln --configuration Release