Use NuGet Trusted Publishing (OIDC) instead of static API key

Exchange the GitHub OIDC token for a short-lived NuGet key via
NuGet/login@v1 at push time, dropping the long-lived NUGET_DEPLOY_KEY.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sunnamed434

.github/workflows/RocketModFix.UnityEngine.Redist.yaml

@@ -12,6 +12,10 @@ jobs:
   build:
     name: "RocketModFix.UnityEngine.Redist Pack"
     runs-on: ubuntu-22.04
+    # Trusted Publishing: id-token lets NuGet/login mint a short-lived key via OIDC.
+    permissions:
+      contents: read
+      id-token: write
     steps:
     - uses: actions/checkout@v7
 
@@ -27,11 +31,17 @@ jobs:
     - uses: nuget/setup-nuget@v4
       name: Setup NuGet
       with:
-        nuget-api-key: ${{ secrets.NUGET_DEPLOY_KEY }}
         nuget-version: '5.x'
-        
+
     - name: Pack
       run: nuget pack redist/RocketModFix.UnityEngine.Redist.nuspec
 
+    # Exchange the GitHub OIDC token for a ~1h NuGet key, right before push.
+    - name: NuGet login (OIDC -> temp API key)
+      uses: NuGet/login@v1
+      id: nuget-login
+      with:
+        user: ${{ secrets.NUGET_USER }}
+
     - name: Push to NuGet
-      run: dotnet nuget push *.nupkg --api-key ${{ secrets.NUGET_DEPLOY_KEY }} --source https://api.nuget.org/v3/index.json
+      run: dotnet nuget push *.nupkg --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json