Track and remove CFSClean policy bypass for 'tools - azsdk-cli' pipeline

## Context

In [`eng/pipelines/templates/stages/1es-redirect.yml`](https://github.com/Azure/azure-sdk-tools/blob/main/eng/pipelines/templates/stages/1es-redirect.yml), the `tools - azsdk-cli` pipeline was added to the exception list that sets:

```yaml
networkIsolationPolicy: Permissive
```

instead of the default:

```yaml
networkIsolationPolicy: Permissive, CFSClean
```

This bypasses the **CFSClean** network isolation policy for the `tools - azsdk-cli` pipeline as a short-term unblock.

## Problem

Bypassing `CFSClean` is a policy violation and should not be a permanent state. We need to track this exception and work toward removing it.

## Proposed follow-up

- Investigate whether `tools - azsdk-cli` can migrate to use the same build/restore script/approach already used elsewhere in the tools repo so it complies with `CFSClean` instead of bypassing it.
- Once compliant, remove `tools - azsdk-cli` from the CFSClean bypass condition in `1es-redirect.yml`.

## Acceptance criteria

- [ ] `tools - azsdk-cli` builds successfully under `Permissive, CFSClean`.
- [ ] The bypass entry for `tools - azsdk-cli` is removed from `1es-redirect.yml`.

Start in eng/pipelines/templates/stages/1es-redirect.yml and inspect the exception for the tools - azsdk-cli pipeline. Compare its build and restore approach with the other tools pipelines, then run the pipeline under Permissive, CFSClean. Done means the pipeline builds successfully and its bypass entry is removed from 1es-redirect.yml.

Written by the indexing model from the issue text.