ci: build, publish and contributor docs

[Stephanvs]

What changed

• adds Linux and Windows build/test CI with coverage artifacts and summaries
• installs checksum-pinned D2 v0.7.1 before Linux tests and validates generated syntax
• validates, inspects, and smoke-tests the NuGet package
• adds a SemVer tag-triggered NuGet publishing workflow with least-privilege permissions
• adds contributor, local validation, pull-request, and release guidance

Safety

Actions are pinned to immutable SHAs, checkout credentials are not persisted, repository permissions are read-only, and NUGET_API_KEY is exposed only to the final publish step inside the nuget.org environment.

Validation

• both workflow files parse as YAML
• release build and tests pass
• Cobertura coverage is produced
• package validation, content inspection, and clean-consumer build pass
• generated example passes d2 validate
• git diff --check passes