fix(ci): run NuGet OIDC login in caller; pass key to shared template

job_workflow_ref claim in OIDC token must match compact-json-formatter
workflow path for NuGet trusted publisher policy to accept it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ncipollina

.github/workflows/publish-preview.yaml

@@ -12,10 +12,24 @@ on:
 permissions:
   contents: write
   pull-requests: write
-  id-token: write
 
 jobs:
+  get-nuget-token:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    outputs:
+      nuget_api_key: ${{ steps.login.outputs.NUGET_API_KEY }}
+    steps:
+      - name: NuGet Login (OIDC)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
   publish:
+    needs: get-nuget-token
     uses: LayeredCraft/devops-templates/.github/workflows/publish-preview.yml@ci/github-nuget-oidc-login
     with:
       solution: LayeredCraft.Logging.CompactJsonFormatter.slnx
@@ -25,4 +39,4 @@ jobs:
         10.0.x
         11.0.x
       hasTests: true
-    secrets: inherit
+      nuget_api_key: ${{ needs.get-nuget-token.outputs.nuget_api_key }}