[Compute Separation][AH1+AH1B+AH2+AH3] Add the project-mode Aspire transport harness

> **Parallel non-blocking validation.** This issue is outside `BYOC-M1`, is not a required sub-issue of #11965, and is not a prerequisite for #11965 or [internal BYOC #219](https://github.com/serverless-paas-balam/FlexConsumption-BYOC/issues/219). It may land whenever capacity allows.

## Roadmap mapping

| Field | Value |
|---|---|
| Roadmap IDs | `AH1`, `AH1B`, `AH2`, `AH3` |
| Lane | Aspire integration harness |
| Related Feature | #11965, non-blocking |
| Depends on | `HT3` / #11970 and `HP2` / #11967 |
| Blocks | Only later Aspire issue `AH4-M1` |
| Pull request | One optional PR |

## Why this PR exists

Add one runnable multi-process Aspire topology where a test-only Rpc.Client driver and MockWorker initialize both FunctionRpc streams through WorkerProxy and the topology starts/tears down cleanly. The shell, wire-up, build check, and smoke are bundled because none is useful independently.

## Source material

- `Functions-NoPlaceholders@brettsam/ga_plan/docs/host/ga/roadmap.md`, rows AH1/AH1B/AH2/AH3 and gate HI1A.
- Reference-only `origin/feature/compute_separation/tools/ComputeSeparation/AppHost`, `MockWorker`, focused solution, and README.
- Current `src/Functions.Rpc.Client`, PR #11964, `src/Functions.WorkerProxy`, and their test fixtures.

The first slice must use a test-only Client driver and must not reintroduce `FUNCTIONS_WORKER_EXTERNAL_ENABLED` or wait for production composition.

## Current state

WorkerProxy shell/relay and Rpc.Client transport exist, and the client-backed channel is in flight. No harness exists on `dev`, so contributors cannot F5 the topology, see correlated output, or prove two real processes attach to one relay session.

Metadata, invocation, HTTP, containers, and production composition remain intentionally impossible after this issue.

## Proposed implementation

1. Add `tools/ComputeSeparation/ComputeSeparation.slnx` referencing only the harness, Rpc.Client, WorkerProxy, and their focused tests. Do not add harness projects to shipping solutions.
2. Add an Aspire AppHost project with standalone-tool package/version settings, referencing WorkerProxy, MockWorker, and a harness-only Client driver.
3. Add MockWorker behavior: connect to WorkerProxy's worker-facing endpoint, send `StartStream` with fixed worker ID, answer `WorkerInitRequest`, advertise realistic capabilities/HttpUri, then idle. Do not wire HTTP yet.
4. Add a harness-only Client driver that composes `RpcClientFactory`, `FunctionRpcDuplexChannelFactory`, and the HT3 `RpcClientWorkerChannel` against WorkerProxy's runtime listener. No ScriptHost or production DI.
5. Add project resources `worker-proxy`, `client-driver`, and `mock-worker` with Aspire-allocated dynamic endpoints and `WaitFor` readiness. Configure existing WorkerProxy option keys; do not invent product flags.
6. Generate any credential per AppHost run and inject it only via environment. Prefer no credential for this slice. Never port prototype literals such as `dev-master-key`, `CONTAINER_ENCRYPTION_KEY`, fixed JWT audiences, or well-known Azurite keys.
7. Add project-mode launch settings for local plaintext only; no container profile.
8. Add `Aspire.Hosting.Testing` smoke assertions with bounded startup and teardown.
9. Add a build-only CI leg for changes under Rpc.Client, WorkerProxy, or `tools/ComputeSeparation`. It restores/builds only; no Docker/DCP runtime and no required-check promotion.

## Tests and evidence

- All three resources reach ready within a bounded timeout.
- WorkerProxy has runtime and worker attachments for the same relay session.
- Client driver establishes EventStream; MockWorker sends StartStream and receives init.
- One worker/session correlation ID appears in all three outputs.
- Disposing the distributed application closes both relay sides and leaves no process or port orphan.
- Shipping solutions and standard WebHost publish/deps remain unchanged; no `src` project references `tools`; no topology flag is added.
- Build-only CI leg passes and remains non-required.

The exit signal for AH4-M1 is a stable project-mode topology with both FunctionRpc legs initialized.

## Explicit exclusions

No metadata/load/invocation/HTTP, SampleIsolatedApp, real worker, production compute Host, link/capacity APIs, containers/images, Proxy management APIs, checked-in credentials, auth/TLS, drain/reconnect, multi-worker, extension gRPC, assembly streaming, broad diagnostics, required CI, or artifact publication.

## PR stop condition

Stop when project mode starts WorkerProxy, Client driver, and MockWorker; both FunctionRpc legs initialize under one correlation ID; teardown is clean; build-only CI passes; and the standard product is unchanged. Do not add invocation, HTTP, real workers, containers, management APIs, or compute composition.