Add a nightly NuGet audit run so new advisories surface on their own schedule

[lgamorim]

Why

NuGet audit validates against the live advisory database at restore time, so a green CI check can silently go stale with zero code change. This is exactly how master went red on 2026-08-13: GHSA-q939-rpr3-3284 was published hours after #17's CI had passed, and the stale-green merge carried the failure onto master, attributed to an unrelated OS-matrix change.

A scheduled restore on master catches new advisories within a day and attributes the failure to the advisory itself instead of to whoever happens to merge next. Together with the ruleset's new strict required-status-checks policy (which blocks stale-green merges at the button), this closes both halves of the window.

What

One workflow, one job, three steps — checkout, setup .NET, dotnet restore:

• Restore is the whole check. TreatWarningsAsErrors in Directory.Build.props already escalates NU19xx audit warnings to restore failures, so no build or tests are needed — the CI matrix covers those on every push.
• schedule (03:00 UTC) + workflow_dispatch only — never reports on PRs, so it stays outside the required-checks list, same as Docs.
• Linux only — the advisory database is identical everywhere; the 08-13 failure was byte-for-byte the same on all three OS legs.
• Activates on merge — GitHub runs cron workflows only from the default branch.

A red run notifies the repo owner by email via GitHub's default workflow-failure notification.

🤖 Generated with Claude Code