Distribution release. No source changes: the compiled assemblies are identical to v1.127.0. What changed is where the packages are published, how the release authenticates, and what the listing looks like.

No consumer action required.

Added

• The packages are now on nuget.org. They previously went only to GitHub Packages, whose NuGet registry requires a personal access token with read:packages even for public packages. That meant dotnet add package MMCA.Common.API returned a 401 for everyone outside the owning account, and a nuget.org search for MMCA.Common returned no hits at all. Both registries now receive every release from the same tag and the same pack step, so they cannot drift. GitHub Packages is retained as a mirror.
• Package listing metadata: project URL, an embedded icon, and tags, set once for all fifteen packages.

Changed

• Release authentication is keyless. Both publishing jobs exchange a GitHub OIDC token via NuGet/login@v1 for an API key valid one hour, immediately before the push. No long-lived credential exists in the repository, so there is nothing to leak and nothing to rotate. The exchange is authorized by a policy pinned to the permanent GitHub ids of the owner, the repository, and the workflow file.
• The README is rewritten as the package listing page it already was (it ships inside every package): what the framework is, the install line, the fifteen-minute path through MMCA.Helpdesk, and links to the reference library, ADR index, and scorecard.

Install

dotnet add package MMCA.Common.API