feat(dotnet): add .NET bindings and NuGet packaging

[lpperras]

Summary

Adds first-party .NET bindings for pdf-inspector and packages them as Firecrawl.PdfInspector, with an API aligned to the existing WebAssembly wrapper.

Native and managed bindings

• Adds a Rust cdylib wrapper with a stable C ABI and UTF-8 JSON contracts.
• Contains Rust panics at the FFI boundary and provides explicit result-buffer ownership/freeing.
• Adds a netstandard2.0 C# library using P/Invoke, with strongly typed options, results, exceptions, and ABI compatibility checks.
• Exposes PDF processing, detection, classification, text extraction, version reporting, and selective OCR.
• Embeds the built-in CMaps so NuGet consumers do not depend on files from the source tree.

NuGet packaging

• Adds the Firecrawl.PdfInspector package with Source Link, symbols, and package documentation.
• Bundles native libraries for win-x64, linux-x64, linux-arm64, and osx-arm64 in one package under the standard RID runtime layout.
• Fails release packing when any supported native asset is missing.
• Adds an installed-package smoke test and local native build support for the managed test project.

CI and publishing

• Adds cross-platform .NET/native test coverage to CI, including OCR routing/runtime validation.
• Adds a NuGet workflow that builds and tests each RID, assembles and inspects the package, installs it into a clean smoke project, and uploads the package as an artifact during manual dry runs.
• Uses NuGet trusted publishing/OIDC for automatic publication from main; manual dispatches never authenticate or publish.
• Extends the shared version synchronization tooling to include the managed and native .NET projects.

Documentation

• Documents installation, API usage, OCR runtime requirements, page-numbering conventions, threading, packaging, and release setup.

Validation

• Rust: 1,029 unit tests and 165 integration tests pass.
• .NET: 9 managed/native tests pass in Release configuration.
• Clippy passes with warnings denied for the root and native crates.
• Native formatting and package version synchronization checks pass.
• The NuGet package-only workflow was exercised successfully across all four supported RIDs.

Required before merge: NuGet trusted-publishing policy

A NuGet.org trusted-publishing policy must be created before this PR is accepted, so the repository can publish Firecrawl.PdfInspector through .github/workflows/publish-nuget.yml using the nuget GitHub environment. The corresponding NuGet.org profile name must also be stored as the repository secret NUGET_USER.

There are two ownership options:

1. I can create/configure the policy and bootstrap the package under my NuGet.org account, then coordinate ownership with the maintainers.
2. A Firecrawl repository owner can create it under the organization's preferred NuGet.org account, ensuring the project owns the package and publishing policy from the outset. This is the recommended option.

Please let me know which ownership path you prefer before merging.

---

Summary by cubic

Adds first-party .NET bindings for pdf-inspector and packages them as the Firecrawl.PdfInspector NuGet package, with an API aligned to the existing WebAssembly wrapper. Previously there were no .NET bindings; .NET consumers can now process, classify, extract, and OCR PDFs locally without the Rust toolchain.

New Features

• A cdylib wrapper exposes a stable C ABI with UTF-8 JSON contracts, contains Rust panics, and defines explicit result-buffer ownership and freeing.
• The managed netstandard2.0 library uses P/Invoke with strongly typed options, results, exceptions, and an ABI version check.
• Stream and async overloads cover processing, detection, classification, text extraction, and selective OCR.
• Native libraries for win-x64, linux-x64, linux-arm64, and osx-arm64 ship in one package under the RID runtime layout.
• CMaps are embedded via an opt-in embedded-cmaps feature used by the .NET and WASM crates; default native Rust builds keep file-based CMaps.
• OCR dependencies stay external and load only when OCR is routed.
• Release packing fails when any supported native asset is missing.
• CI tests each RID and OCR routing; the NuGet workflow assembles, inspects, and smoke-tests the installed package, and publishes from main via trusted publishing while manual runs only produce artifacts.
• NuGet publishing is serialized per ref and tolerates a missing previous version so first-time publishes work.

Migration

• Before merge, the repository needs a NuGet.org trusted-publishing policy for firecrawl/pdf-inspector and the NUGET_USER secret.

^{Written for commit fa9b2fd. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 28 files

<sub>Shadow auto-approve: would not auto-approve because issues were found.
Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 7 files (changes from recent commits).

<sub>Shadow auto-approve: would require human review. Adds first-party .NET bindings and automated NuGet publishing; the PR defers package ownership/trusted-publishing setup to maintainers and opens a new consumer-facing API contract.

Re-trigger cubic</sub>