ci: land the SHA pins, Dependabot and the consumer smoke test on main (recovers #5, #9) - #13

Every layer of the suite references the projects directly. A
ProjectReference hides exactly what breaks for a consumer of the package:
a satellite whose nuspec fails to declare the core package, a version
range that lets NuGet resolve a different core than the one built here, a
type public in the project and missing from the package, a plugin that
registers through a project reference and not through the assembly a
consumer restores. Each packs cleanly and restores cleanly, and the first
person to notice is a consumer.

test/consumer-smoke-test.sh packs the four packages, restores them into
throwaway projects created outside the repository — inside it,
Directory.Build.props would apply and they would stop resembling anything
a consumer builds — compiles real code against them, runs it, and asserts
on what it prints and on the SQL the EF plugins translate. Never on the
exit code alone. Two consumers: core only (parse, algebra, JSON round
trip, value set canonical form), and the NodaTime EF satellite, which
pulls all four through the nuspec chain — the chain itself is asserted
from `dotnet list package --include-transitive`, each id at this version —
and translates a BCL range, a NodaTime range and a value set predicate to
SQL through ToQueryString, which never connects.

Two things carried over from the sibling repository because they were
learned the hard way there: NUGET_PACKAGES redirected to a private folder,
since NuGet resolves id+version from the global cache before any source
and a locally built package is otherwise shadowed by whatever build of
that version was restored before; and package source mapping in the
generated nuget.config, so this repository's ids come from the local feed
only and everything else from nuget.org — restricting the whole restore
to the local feed fails with NU1101 on the transitive dependencies.

Wired into both workflows in both invocation modes: a `consumer` job on
every PR that packs its own feed, and a step in the pack job and in the
release gate that is handed the pre-built dist — the artifacts published
are the artifacts tested. The script builds before it packs, so it works
whether or not GeneratePackageOnBuild is set.

Verified: passes in both modes locally. Sabotaging the mechanism — the
NodaTime satellite no longer calling UseValueRanges() — fails the run.
actionlint clean.

Co-Authored-By: Claude Fable 5 <[email protected]>

test: add a consumer smoke test that exercises delivery, not code

…recover/pins-dependabot-smoke-test

# Conflicts:
#	CLAUDE.md