ci: narrow the publish workflow to tags and dispatch

It also triggered on every push and PR touching src/Base58Encoding/**, where it
only restored and built: Pack and Upload are gated on a version being set, so
those runs never produced anything. tests.yml and aot-tests.yml already build
the same solution across more platforms.

The Test step stays. tests.yml does not run on a tag -- a branches: filter never
matches refs/tags/* -- so it is the only thing that runs the suite against a tag
cut from anywhere other than an already-tested master commit.

Author: unsafePtr

.github/workflows/publish-nuget.yml

@@ -1,26 +1,12 @@
 name: Build and Publish to NuGet
 
+# Release-only: tags and manual dispatch. Ordinary pushes and PRs are covered by tests.yml and
+# aot-tests.yml, which build the same solution across more platforms -- this one used to duplicate
+# that on every library change while never packing, since Pack is gated on a version being set.
 on:
   push:
     tags:
       - 'v*.*.*'
-    branches: [ master, main ]
-    paths:
-      - 'src/Base58Encoding/**'
-      - 'src/Directory.Build.props'
-      - 'src/Directory.Packages.props'
-      - 'src/NuGet.Config'
-      - 'src/PACKAGE.md'
-      - 'global.json'
-  pull_request:
-    branches: [ master, main ]
-    paths:
-      - 'src/Base58Encoding/**'
-      - 'src/Directory.Build.props'
-      - 'src/Directory.Packages.props'
-      - 'src/NuGet.Config'
-      - 'src/PACKAGE.md'
-      - 'global.json'
   workflow_dispatch:
     inputs:
       version:
@@ -59,9 +45,10 @@ jobs:
     - name: Build
       run: dotnet build src/Base58Encoding.slnx --configuration Release --no-restore
 
-    # Only on the publishing path -- tests.yml covers branches and PRs. It has to stay in this job
-    # rather than lean on that workflow: the two run concurrently, so a red tests.yml would not stop
-    # this one from packing, and a tag push does not trigger it at all (branch filters skip tags).
+    # The release path's own gate. tests.yml never runs on a tag -- a branches: filter does not
+    # match refs/tags/* -- so for a tag cut anywhere other than an already-tested master commit,
+    # nothing else has run the suite against this ref. Skipped only for a dispatch with no version,
+    # which builds without packing.
     - name: Test
       if: env.VERSION != ''
       run: dotnet test --project src/Base58Encoding.Tests/Base58Encoding.Tests.csproj --configuration Release --no-build --verbosity normal