Keep PR NuGet cache isolation within valid GitHub Actions contexts

[wieslawsoltes]

Problem

After WebScene PR #71 merged, the NuGet package workflow was rejected before any job started. The consumer job declared a job-level environment value using runner.temp. GitHub does not expose the runner context while it evaluates job-level env, so the workflow was invalid.

Failing run: https://github.com/SceneTech/WebScene/actions/runs/35015568525

actionlint reported:

context "runner" is not allowed here

Proposed fix

Use github.workspace plus a run-, attempt-, and RID-specific path for NUGET_PACKAGES. This keeps same-version PR package restores isolated on persistent self-hosted runners while using a context valid at job evaluation time. Keep the cache under artifacts so its lifecycle is bounded by the runner workspace cleanup.

Acceptance

• actionlint accepts native-runtime-packages.yml.
• The workflow creates all expected jobs instead of failing at definition time.
• macOS and Linux package consumers restore and run using isolated per-run package roots.
• No package cache is uploaded as release output.

Implemented on the open Code OSS integration branch in commit 59c3e09; keep the fix in draft PR #76 until its full package matrix passes.

[wieslawsoltes]

Reconciliation against current main (1c18c70c06b10e994d28f428c5d1a7f095ff7ef8): the issue remains fully resolved; no follow-up code change is required.

Exact evidence:

• The focused cache-context change reached main through merged PR Repair focused PR validation on self-hosted runners #144. Merge commit b594566c1d5d64db685c273adeaa09858fa4b843 changes the package-consumer job-level value from runner.temp to ${{ github.workspace }}/artifacts/nuget-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.rid }}.
• Current main still contains that exact value. Piping the current remote workflow into actionlint 1.7.8 completes with no diagnostics.
• Complete package run https://github.com/SceneTech/WebScene/actions/runs/35142541711 finished successfully. Its Package consumer osx-arm64 and Package consumer linux-x64 jobs both passed Restore clean package consumer and Build and run clean package consumer.
• The run uploaded ten expected package/runtime/compatibility/release artifacts. The artifact inventory contains no NuGet cache artifact.
• PR Use valid contexts for PR NuGet cache isolation #132 was therefore an empty duplicate after Repair focused PR validation on self-hosted runners #144 merged and was correctly closed without merge. Draft consolidation PR Add Code OSS browser and native desktop compatibility #76 remains open and unmerged.

This satisfies all acceptance points from the issue: valid workflow evaluation, created jobs, isolated macOS/Linux restores, successful consumers, and no cache publication.