Define repo-owned package build contract

[bytemaster-0xff]

Establishes the first go compile yourself contract for a package-producing repository.

• feature branches and PRs build/test/pack the repo-owned LagoVista.Core package
• the repo emits both the immutable .nupkg and a machine-readable package-catalog.json
• publishing remains explicit/manual for now
• no platform manifest mutation is wired yet
• the canary continues to enforce that LagoVista.Core has no internal LagoVista dependencies

This deliberately stops at the part of the workflow we already understand. Promotion from feature to master and adoption into nuviot/platform will be layered on after this contract is proven.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE