Prepare 1.0.0-beta.3 release

[paulirwin]

Prepares the first tagged release of the project. There are currently no git tags and no GitHub releases, so this establishes the release path rather than following an existing one.

Version sync

Both <Version> properties move to 1.0.0-beta.3. They had drifted — the app csproj was at 1.0.0-beta while the Aspire package was at 1.0.0-beta.2 — so a single tag now names one version across both artifacts.

Staying on the 1.0.0-beta.N line rather than declaring 1.0.0: the emulator is still filling in API surface against real Azure AI Search, and anything still missing would become a semver-breaking fix later.

NuGet publishing

F23.Aspire.Hosting.AzureSearchEmulator had no release automation at all — nothing packed or pushed it, so the published package has been stale at 1.0.0-beta.2. The new nuget-publish.yml triggers on the same v*.*.* tags as the existing Docker workflow.

It authenticates with NuGet trusted publishing (OIDC) rather than a stored API key, so there is no long-lived credential in the repo. id-token: write is scoped to the publishing job only, and the login step sits immediately before the push because each OIDC token is single-use and the key it returns expires after an hour.

Worth flagging for review: a widely-circulated blog post on this reads the key from steps.login.outputs.api-key, which is wrong and silently yields an empty key. The correct output is NUGET_API_KEY, verified against the action's own action.yml.

Required before the tag is pushed

Two one-time setup items that can't be done from the repo:

1. Trusted publishing policy on nuget.org — your username → Trusted Publishing → owner feature23, repository AzureSearchEmulator, workflow file nuget-publish.yml (filename only, no path), environment blank. Policies are owner-scoped, so this works even though the package has never been published from CI. A new policy is provisionally active for 7 days and only becomes permanent after one successful publish.
2. NUGET_USER repo secret — the nuget.org profile name, not an email address.

Release notes

Separately from this diff, all 28 merged PRs have been labeled with notes:* categories so .github/release.yml sorts them properly — the 21 in this release plus 7 older ones that would otherwise have landed under "Other Changes".

Verification

• Release build clean, 0 warnings
• 812 unit tests, 178 integration tests passing
• dotnet pack produces .nupkg and .snupkg at 1.0.0-beta.3
• Workflow YAML parsed and structure asserted; the OIDC exchange itself is untestable until the policy exists

🤖 Generated with Claude Code