ci: harden Windows NuGet dry runs

[Connor Peet (connor4312)]

Summary

• make generated-artifact verification stable on Windows checkouts
• normalize CRLF before exact release-metadata formatting comparisons
• force canonical LF checkout for generated .NET sources and release metadata
• restore the Native AOT package smoke test through an isolated NuGet configuration to avoid dotnet restore will treat all sources as local if the first source is local NuGet/Home#14624
• consume the merged signed NuGet pipeline template from microsoft/vscode-engineering@main

Validation

• npm test
• fresh checkout with core.autocrlf=true: npm run generate:dotnet leaves generated sources clean
• npm run verify:release-metadata under Windows-style checkout conditions
• Azure DevOps signed dry run build 468604 passed build, tests, Native AOT package consumption, ESRP content signing, NuGet signing, and signed artifact publication with publish: false
• updated pipeline YAML parses successfully

Final ADO verification

Target branch: connor4312/nuget-dry-run-fixes

Run once more at 493cf741 with the default publish: false. This verifies the exact merged vscode-engineering@main template before this PR is made ready and merged.

[Connor Peet (connor4312)]

Second ADO dry-run fix

The next failure was also caused by Windows line-ending conversion: committed generated C# was checked out as CRLF, then npm run generate:dotnet rewrote LF and the drift check correctly saw every generated file as modified.

Added .gitattributes rules forcing LF for generated .NET sources and generated release metadata. Validated in a fresh checkout configured with core.autocrlf=true: the files materialized as LF, npm run generate:dotnet left both generated directories clean, and npm run verify:release-metadata passed.

Please rerun the pipeline targeting connor4312/nuget-dry-run-fixes at 4eaa47f6.

[Connor Peet (connor4312)]

Third ADO dry-run fix

The solution restore had already succeeded with the authenticated internal feed, so the feed and credentials are valid. The Native AOT restore failed when its folded, multi-source script command ran through cmd.exe and NuGet received the HTTPS source as a relative Windows path.

Commit b347c96c changes only that restore step to pwsh and passes every dotnet argument through an explicit PowerShell array, preserving the local package directory and HTTPS feed as separate source arguments. The updated pipeline YAML parses successfully.

Please rerun the pipeline targeting connor4312/nuget-dry-run-fixes at b347c96c.

[Connor Peet (connor4312)]

Fourth ADO dry-run fix

The complete build logs confirm NUGET_RESTORE_SOURCE is set correctly and succeeds for the solution restore. The failure occurs only when NuGet receives a local package directory followed by the HTTPS feed through repeated --source options. This matches NuGet/Home#14624, where Windows path normalization mangles a later HTTPS source into a project-relative path.

Commit fa39b49f avoids that NuGet/MSBuild code path rather than relying on source ordering: the AOT smoke step writes an isolated temporary NuGet.config with <clear />, the signed local package directory, and the authenticated VS Code feed, then restores with --configfile. No credentials are written; authentication remains provided by NuGetAuthenticate@1. The updated YAML parses successfully.

Please rerun the pipeline targeting connor4312/nuget-dry-run-fixes at fa39b49f.

[Connor Peet (connor4312)]

The shared template is now merged in microsoft/vscode-engineering@main. Commit 493cf741 removes the scratch-template reference and points this pipeline at refs/heads/main. Please run one final signed dry run against this commit with publish: false; after it passes, this PR can be marked ready and merged.