ci: harden dependency restore and token defaults

[EricSun0218]

Summary

• enforce NuGet lock files in both ordinary and trusted .NET restore gates
• default the privileged trusted workflow token to no permissions, preserving only explicit per-job grants

Verification

• Release version consistency check
• Release version consistency self-test
• Trusted workflow contract self-test
• locked-mode solution restore
• clean diff validation

[EricSun0218]

Superseded by #9, which contains the identical two-file change as a GitHub-signed and verified commit so required-signature protection remains fully enforced.