Add deterministic Release integration NuGet upgrade payload staging for legacy packages.config validation

[Copilot]

This change adds the build/payload half of the legacy packages.config upgrade validation follow-up: produce and publish a deterministic local Roslyn package source that mirrors roslyn-tools’ active publish set, with strict pre-test validation.

• Manifested source-of-truth package set

  • Added eng/config/NuGetPackageUpgradePayload.json with the 21 active Roslyn package IDs.
  • Included an explicit synchronization pointer to dotnet/roslyn-tools/.../NuGetPublish.cs (active entries only).

• Payload preparation + validation script

  • Added eng/prepare-nuget-package-upgrade-payload.ps1 to:
    • read expected IDs from the checked-in manifest
    • load nuspec metadata directly from .nupkg archives in artifacts/packages/<Configuration>/Shipping
    • derive the single candidate version from Microsoft.Net.Compilers.Toolset
    • require exactly one package per expected ID at that version
    • fail on missing packages, duplicate identities, malformed nupkgs/nuspecs, filename/identity ambiguity, and version skew
    • validate Roslyn-family dependency declarations/ranges against the manifest + candidate version
    • record non-Roslyn dependencies as external
    • stage only validated expected packages into artifacts/packageValidation/<Configuration>/packages
    • emit deterministic artifacts/packageValidation/<Configuration>/package-manifest.json (ordered packages/dependencies; id/version/path/size/sha256/dependencies + deduped external deps)

• Release integration pipeline wiring (non-DartLab path)

  • Updated eng/pipelines/build-windows-job.yml with an opt-in buildNuGetUpgradePayload path that runs pack, runs the new preparation script, and publishes a separate artifact.
  • Updated eng/pipelines/test-integration-helix.yml to enable that path only for Release.
  • Artifact name is Roslyn_NuGet_Packages_Release.
  • Debug behavior unchanged; DartLab integration templates/pipeline remain untouched.

• Focused validator coverage

  • Added eng/tests/prepare-nuget-package-upgrade-payload.tests.ps1 covering required failure modes:
    • missing expected package
    • duplicate package identity
    • version skew
    • undeclared Roslyn-family dependency

Example output contract produced by the script:

{
  "candidateVersion": "x.y.z",
  "packages": [
    {
      "id": "Microsoft.CodeAnalysis",
      "version": "x.y.z",
      "path": "packages/Microsoft.CodeAnalysis.x.y.z.nupkg",
      "size": 12345,
      "sha256": "<hash>",
      "dependencies": [
        { "id": "Microsoft.CodeAnalysis.Common", "versionRange": "[x.y.z]", "targetFramework": "" }
      ]
    }
  ],
  "externalDependencies": [
    { "id": "Newtonsoft.Json", "versionRange": "[13.0.3]", "targetFramework": "" }
  ]
}

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.