Release: call the full CI workflow before publishing, and a nightly full run #74

Decided in decision 113, part of #118. dotnet.yml gains on: workflow_call. release.yml's new ci job calls it, and verify needs it. Its concurrency group is ci-${{ github.workflow }}-${{ github.ref }}: a called workflow takes its caller's name, and groups ignore case (KB-043), so without the prefix the call would share release-<tag> with its caller. A conventions test holds the two groups apart. nightly.yml dispatches dotnet.yml on main and every release/* branch each night. It starts once 2.3.0 merges into main, since a schedule runs only from the default branch.

Problem

release.yml's Verify and pack runs the suite, the probe replay and gate, pack and the smoke test against dist, all on Linux. It runs neither the Windows and macOS legs nor the smoke test's own-feed mode. It relies on the tagged commit having passed them on a PR or a push, which stops holding once PR jobs can be skipped (#70, #73). Nothing runs CI unless something is pushed, so drift goes unnoticed until a push: runner images, the SDK band admitted by global.json, the PostgreSQL image, and nuget.org packages in the smoke consumers.

Change

• dotnet.yml gains on: workflow_call. release.yml calls it and its verify job needs it. Use distinct concurrency groups, or the two deadlock.
• A nightly schedule runs every lane on the default branch, and dispatches the open release branch.
• GitHub turns off schedules in public repositories after 60 days without activity, so the release must not depend on the nightly.

Done when

A dry-run release runs every lane, Windows and macOS included, before Publish, and a seeded failing leg stops it. Nightly runs appear for main and the release branch.