IPublish: multi-channel, package-ID-aware publishing

[ChrisonSimtian]

Part of #332 (first concrete step — closes the immediate dogfooding gap).

IPublish.Publish today pushes all *.nupkg to a single NuGetSource with a single key. Our own release workflows therefore can't use it and inline dotnet nuget push in hand-written YAML instead.

Extend IPublish (or add a richer publish surface) to model:

• Multiple targets in one run: GitHub Packages, nuget.org, GitHub Releases.
• Package-ID routing: Fallout.* → nuget.org (opt-in) + GH Packages; Nuke.* shims → GH Packages only, never nuget.org ([P5] Ship Nuke.* type-forwarding shim packages on our GH Packages feed #47).
• Per-lane/channel selection: alpha/preview → GH Packages only; GA → nuget.org opt-in + GH Releases.
• Idempotent push (--skip-duplicate), per-target keys/sources.

Done when experimental.yml/preview.yml/release.yml can drop their inline dotnet nuget push and call dotnet fallout instead.

[ChrisonSimtian]

Progress — implemented on experimental, promotion to main in review

Status: in review (not done — stays open until merged to main).

Landed on experimental (PR #339 + token fix #340):

• PublishTarget + pure, unit-tested PublishPackageRouter (glob include/exclude by package name) — new tests/Fallout.Components.Tests (10 tests).
• IPublish gained [Experimental("FALLOUT001")] PublishTargets + --publish-to; Publish fans one Pack output across feeds. Additive — legacy single-feed members retained.
• Build.cs wires the two real channels: github-packages (every package incl. Nuke.*, GitHub-token keyed) + nuget.org (Fallout.* only, never Nuke.*, NUGET_API_KEY keyed).
• experimental.yml / preview.yml now dogfood dotnet fallout Publish --publish-to github-packages instead of hand-rolled dotnet nuget push.

Validated end-to-end: the post-merge experimental publish ran for real — dotnet fallout Publish built, tested, packed, and published -alpha to GitHub Packages successfully. (The live run surfaced + fixed the GITHUB_TOKEN env wiring, #340.)

Promotion to main: PR #342 (experimental → main, curated cherry-pick keeping main on -preview) — open for human review ahead of RC. The [Experimental] attribute stays until the CD model (#334) settles and the surface is promoted to stable.

Carve-out: release.yml's publish jobs still use raw dotnet nuget push — coupled to the cross-job artifact handoff + the nuget-org approval gate, so dogfooding those is folded into #336.

Keeping this issue open until #342 merges to main.