implement ADO packaging pipeline for FLC & SDK (#552)

## Foundry Local Packaging Pipeline

### Summary

This PR introduces the **Foundry Local Packaging Pipeline**, a unified
ADO pipeline that builds, signs, and tests Foundry Local Core (FLC) for
all platforms, packages it as NuGet and Python wheels, then builds,
signs, and tests the C#, JS, Python, and Rust SDKs — for both standard
and WinML variants.

**Pipeline stages:**
1. **Build FLC** — Native AOT binaries for win-x64, win-arm64,
linux-x64, osx-arm64
2. **Package FLC** — Multi-platform NuGet package + Python wheels from
the built binaries
3. **Build SDKs** — C#, JS, Python, Rust using the packaged FLC
4. **Test SDKs** — Validate each SDK against the pipeline-built FLC

**Produced artifacts:** `flc-nuget`, `flc-nuget-winml`, `flc-wheels`,
`flc-wheels-winml`, `cs-sdk`, `cs-sdk-winml`, `js-sdk`, `js-sdk-winml`,
`python-sdk`, `python-sdk-winml`, `rust-sdk`, `rust-sdk-winml`

**SDK Changes:**
1. Adds ability for python sdk to skip installing native depenencies and
use pre-installed binaries like `foundry-local-core`, `onnxruntime`,
`onnxruntime-genai`
2. Adjusts APIs to leverage new download_and_register_eps native interop
call for manually downloading and registering EPs
3. Adds temporary nuget.config to github actions c# pipeline to allow
ORT-Nightly to auto-fetch missing dependencies from upstream nuget.org

### Test coverage

All SDK tests currently run on **win-x64 only**. Additional platform
test jobs are blocked on infrastructure:

- **Windows ARM64** — waiting on a 1ES-hosted win-arm64 pool
- **macOS ARM64** — waiting on a 1ES-hosted macOS ARM64 pool
- **Linux x64** — waiting on the Linux onnxruntime dependency to be
stabilized

TODOs are tracked in the pipeline YAML for each.

### Build strategy

All FLC builds (including win-arm64 and osx-arm64) run on **x64
machines** because .NET Native AOT supports cross-compilation. The
win-arm64 build cross-compiles from x64 Windows — see [Cross-compilation
docs](https://learn.microsoft.com/en-us/dotnet/core/deploying/native-aot/cross-compile#windows).
Linux builds run on its own respective x64 hosted image.

### Origin

- **Foundry Local Core build steps** were lifted from
`neutron-server/.pipelines/FoundryLocalCore/`
- **SDK build/test steps** were lifted from `Foundry-Local/.github/`

---------

Co-authored-by: Prathik Rao <prathikrao@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/build-cs-steps.yml

@@ -41,19 +41,41 @@ jobs:
         env:
           NUGET_AUTH_TOKEN: ${{ secrets.AZURE_DEVOPS_PAT }}
 
+      - name: Generate temporary NuGet.config
+        run: |
+          # The repo-level NuGet.config cleared all sources and only included ORT-Nightly.
+          # We generate a temporary one with both nuget.org and ORT-Nightly.
+          # We provide credentials to allow the ORT-Nightly feed to pull from its upstreams.
+          $xml = @"
+          <?xml version="1.0" encoding="utf-8"?>
+          <configuration>
+            <packageSources>
+              <clear />
+              <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+              <add key="ORT-Nightly" value="https://pkgs.dev.azure.com/aiinfra/PublicPackages/_packaging/ORT-Nightly/nuget/v3/index.json" />
+            </packageSources>
+            <packageSourceCredentials>
+              <ORT-Nightly>
+                <add key="Username" value="az" />
+                <add key="ClearTextPassword" value="${{ secrets.ORT_NIGHTLY_PAT }}" />
+              </ORT-Nightly>
+            </packageSourceCredentials>
+          </configuration>
+          "@
+          Set-Content -Path sdk/cs/NuGet.temp.config -Value $xml
+        shell: pwsh
+
       # TODO: once the nightly packaging is fixed, add back the commented out lines with /p:FoundryLocalCoreVersion="*-*"
       # /p:FoundryLocalCoreVersion="*-*" to always use nightly version of Foundry Local Core
-      - name: Authenticate to Azure Artifacts NuGet feed
-        run: dotnet nuget update source ORT-Nightly --username az --password ${{ secrets.AZURE_DEVOPS_PAT }} --store-password-in-clear-text --configfile sdk/cs/NuGet.config
-
       - name: Restore dependencies
         run: |
-          # dotnet restore sdk/cs/src/Microsoft.AI.Foundry.Local.csproj /p:UseWinML=${{ inputs.useWinML }} /p:FoundryLocalCoreVersion="*-*" --configfile sdk/cs/NuGet.config
-          dotnet restore sdk/cs/src/Microsoft.AI.Foundry.Local.csproj /p:UseWinML=${{ inputs.useWinML }} --configfile sdk/cs/NuGet.config
+          # Clear the local NuGet cache to avoid bad metadata or corrupted package states.
+          dotnet nuget locals all --clear
+          # Restore using the temporary config file with credentials.
+          dotnet restore sdk/cs/src/Microsoft.AI.Foundry.Local.csproj /p:UseWinML=${{ inputs.useWinML }} --configfile sdk/cs/NuGet.temp.config
 
       - name: Build solution
         run: |
-          # dotnet build sdk/cs/src/Microsoft.AI.Foundry.Local.csproj --no-restore --configuration ${{ inputs.buildConfiguration }} /p:UseWinML=${{ inputs.useWinML }} /p:FoundryLocalCoreVersion="*-*"
           dotnet build sdk/cs/src/Microsoft.AI.Foundry.Local.csproj --no-restore --configuration ${{ inputs.buildConfiguration }} /p:UseWinML=${{ inputs.useWinML }}
 
       # need to use direct git commands to clone from Azure DevOps instead of actions/checkout
@@ -89,6 +111,7 @@ jobs:
       - name: Run Foundry Local Core tests
         run: |
           # dotnet test sdk/cs/test/FoundryLocal.Tests/Microsoft.AI.Foundry.Local.Tests.csproj --verbosity normal /p:UseWinML=${{ inputs.useWinML }} /p:FoundryLocalCoreVersion="*-*"
+          # Use the temporary config file for test restore as well.
           dotnet test sdk/cs/test/FoundryLocal.Tests/Microsoft.AI.Foundry.Local.Tests.csproj --verbosity normal /p:UseWinML=${{ inputs.useWinML }}
 
       - name: Pack NuGet package

.github/workflows/foundry-local-sdk-build.yml

@@ -17,60 +17,8 @@ permissions:
   contents: read
 
 jobs:
-  build-cs-windows:
-    uses: ./.github/workflows/build-cs-steps.yml
-    with:
-      version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-    secrets: inherit
-  build-js-windows:
-    uses: ./.github/workflows/build-js-steps.yml
-    with:
-      version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-    secrets: inherit
-  build-python-windows:
-    uses: ./.github/workflows/build-python-steps.yml
-    with:
-      version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-    secrets: inherit
-  build-rust-windows:
-    uses: ./.github/workflows/build-rust-steps.yml
-    with:
-      platform: 'windows'
-      run-integration-tests: true
-    secrets: inherit
-
-  build-cs-windows-WinML:
-    uses: ./.github/workflows/build-cs-steps.yml
-    with:
-      version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-      useWinML: true
-    secrets: inherit
-  build-js-windows-WinML:
-    uses: ./.github/workflows/build-js-steps.yml
-    with:
-      version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-      useWinML: true
-    secrets: inherit
-  build-python-windows-WinML:
-    uses: ./.github/workflows/build-python-steps.yml
-    with:
-      version: '0.9.0.${{ github.run_number }}'
-      platform: 'windows'
-      useWinML: true
-    secrets: inherit
-  build-rust-windows-WinML:
-    uses: ./.github/workflows/build-rust-steps.yml
-    with:
-      platform: 'windows'
-      useWinML: true
-      run-integration-tests: true
-    secrets: inherit
-
+  # Windows build/test moved to .pipelines/foundry-local-packaging.yml and runs in ADO
+  # MacOS ARM64 not supported in ADO, need to use GitHub Actions
   build-cs-macos:
     uses: ./.github/workflows/build-cs-steps.yml
     with: