[andregoepel]

Core's tag-triggered CI publisher can bypass Sonar readiness, and the completed no-upload rehearsal did not yet exercise authenticated tagged preparation or stored intent. This PR bundles removal of that legacy job with the complete tagged acceptance path for #29.

• Remove only ci.yml's pack-and-publish job and update its exact policy fingerprint. Preserve CI triggers and build/test checks.
• Restrict the registered preparation workflow to sonar-poc/nuget/<32 lowercase hex>/vX.Y.Z and pin its updated bytes. Add a protected acceptance consumer using the existing pinned shared verifier, authenticated origin/batch, stored intent, seven live negative probes, per-file revalidation, local discard and retained outcomes.
• Both test jobs require SONAR_NUGET_ACCEPTANCE_ENABLED=true; this variable is currently absent. The production publisher remains unchanged with literal-false guards. The consumer has no OIDC permission, NuGet login or package upload command.
• Include the combined test/cutover runbook, completed test: add no-upload publication rehearsal #34 rehearsal evidence and explicit remaining controls. Sonar, the previous manual rehearsal, unrelated Actions and other repositories are unchanged.

Validation: Release build and all 8 Core tests passed; 49 offline cases execute the actual event/credential checks and both outcome recorders; Bash syntax, actionlint, CSharpier and the current direct/transitive vulnerability audit passed (zero findings). CI job preservation, exact policy hashes and the unchanged production/Sonar workflows were independently checked.

The new hosted tagged handoff is pending merge and separately authorized protected test setup; local fixtures are not claimed as hosted evidence. No test switch, tag, environment, token or NuGet policy was changed. Removing the current CI job does not revoke the old NuGet Trusted Publisher policy or prevent historical workflow runs from using it; policy migration and production controls remain open. Publishing is not activated, and #29 remains open.

Hosted CI 40090949176, attempt 1 passed on de7fbd2190308d3ed39cabdad0394d78f80d8403, including restore, formatting, build, tests and vulnerability scan. Core has no separate E2E workflow; central Sonar runs on main after merge.

Refs #29. Please review; do not merge automatically.