Update CID context: NuGet account and API key configured

NUGET_API_KEY GitHub Actions secret is now set. Update state.md,
dotnet-bindings spec, and ci-cd spec to reflect NuGet publishing
readiness and add NuGet to registry tables and checklists.

Author: CID Agent

.claude/context/specs/ci-cd.md

@@ -78,6 +78,10 @@ on:
         description: Publish iscc-lib to RubyGems
         type: boolean
         default: false
+      nuget:
+        description: Publish Iscc.Lib to NuGet
+        type: boolean
+        default: false
 ```
 
 ### Job Conditions
@@ -93,6 +97,8 @@ Each job chain activates on either a tag push or its corresponding checkbox:
     `if: startsWith(github.ref, 'refs/tags/v') || inputs.maven`
 - **RubyGems jobs** (build-ruby-gems, publish-rubygems):
     `if: startsWith(github.ref, 'refs/tags/v') || inputs.rubygems`
+- **NuGet jobs** (pack-nuget, test-nuget, publish-nuget):
+    `if: startsWith(github.ref, 'refs/tags/v') || inputs.nuget`
 
 Tag pushes activate all jobs (no inputs are set, but the tag condition passes for all).
 
@@ -104,6 +110,7 @@ Tag pushes activate all jobs (no inputs are set, but the tag condition passes fo
 | **PyPI**          | OIDC trusted publishing      | `pypa/gh-action-pypi-publish@release/v1`                                            |
 | **npm**           | Token (`NPM_TOKEN` secret)   | `NODE_AUTH_TOKEN` env var                                                           |
 | **Maven Central** | GPG signing + Sonatype token | `MAVEN_GPG_PRIVATE_KEY`, `MAVEN_GPG_PASSPHRASE`, `MAVEN_USERNAME`, `MAVEN_PASSWORD` |
+| **NuGet**         | API key (`NUGET_API_KEY`)    | Scoped NuGet.org API key as GitHub Actions secret                                   |
 | **RubyGems**      | OIDC trusted publishing      | RubyGems trusted publisher config (or `GEM_HOST_API_KEY` secret fallback)           |
 
 All jobs that use OIDC require `permissions: id-token: write`. Maven Central uses the Sonatype
@@ -192,6 +199,7 @@ Single build on ubuntu-latest, platform-independent.
 | WASM      | npm           | `@iscc/wasm`                                                       |
 | Java      | Maven Central | `io.iscc:iscc-lib`                                                 |
 | Ruby      | RubyGems      | `iscc-lib`                                                         |
+| C# / .NET | NuGet         | `Iscc.Lib`                                                         |
 | Go        | pkg.go.dev    | `github.com/iscc/iscc-lib/packages/go` (tag-based, no publish job) |
 
 ### Java JNI native libraries (cargo + Maven)
@@ -315,12 +323,14 @@ workflow triggers on push to `main`.
 - [x] `workflow_dispatch` with only `npm: true` builds and publishes only npm packages
 - [x] `workflow_dispatch` with only `maven: true` builds and publishes only to Maven Central
 - [ ] `workflow_dispatch` with only `rubygems: true` builds and publishes only to RubyGems
+- [x] `workflow_dispatch` with only `nuget: true` builds and publishes only to NuGet
 - [x] Each registry's jobs are independent — failure in one does not block others
 - [x] crates.io uses OIDC trusted publishing (no API key secret)
 - [x] PyPI uses OIDC trusted publishing (no API key secret)
 - [x] npm uses `NPM_TOKEN` repository secret
 - [x] Maven Central uses GPG signing + Sonatype Central Portal credentials
 - [ ] RubyGems uses OIDC trusted publishing (or `GEM_HOST_API_KEY` fallback)
+- [x] NuGet uses scoped API key (`NUGET_API_KEY` secret)
 - [x] Python wheels use abi3-py310 (one wheel per platform for Python 3.10+)
 - [x] Java JAR bundles 5-platform native libraries under `META-INF/native/`
 - [ ] Ruby precompiled gems available for 5 platforms (Linux x86_64/aarch64, macOS x86_64/arm64,

.claude/context/specs/dotnet-bindings.md

@@ -180,11 +180,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends dotnet-sdk-8.0
 - .NET built-in Roslyn analyzers with `TreatWarningsAsErrors`
 - No external linting tools needed for thin wrapper
 
-## Account Setup Required
+## Account Setup
 
-1. **NuGet.org account**: Register under ISCC organization
-2. **Package reservation**: Reserve `Iscc.Lib` package ID prefix
-3. **API key**: Create scoped NuGet API key, store as `NUGET_API_KEY`
+- **NuGet.org account**: Registered ✅
+- **API key**: Scoped NuGet API key stored as `NUGET_API_KEY` GitHub Actions secret ✅
 
 ## Verification Criteria
 

.claude/context/state.md

@@ -105,8 +105,7 @@ platform checksums have been added to `packages/cpp/portfile.cmake` and `SKIP_SH
 - `packages/dotnet/README.md` — 82 lines ✅
 - **Known limitation**: `MetaCodeResult`, `TextCodeResult`, `InstanceCodeResult` carry only
     `(string Iscc)` — extra fields require C FFI struct changes first; not blocking
-- **Manual action still needed**: NuGet.org account setup (NUGET_API_KEY secret, package ID
-    reservation) before NuGet publish job can be triggered
+- `NUGET_API_KEY` GitHub Actions secret configured; NuGet publishing pipeline ready
 
 ## C++ Bindings
 
@@ -202,8 +201,7 @@ platform checksums have been added to `packages/cpp/portfile.cmake` and `SKIP_SH
 - `pack-nuget` → `test-nuget` → `publish-nuget` pipeline in place ✅
 - v0.2.0 released successfully across all 8 registries
 - `iscc.hpp` bundled in FFI release tarballs (both Unix `cp` and Windows `Copy-Item` steps) ✅
-- **Manual action still needed**: NuGet.org account setup (NUGET_API_KEY secret, package ID
-    reservation) before NuGet publish job can be triggered
+- `NUGET_API_KEY` GitHub Actions secret configured; NuGet publishing pipeline ready
 
 ## Next Milestone