Create AzDO pipeline for signing and publishing CLI acquisition scripts

## Summary

The public CLI acquisition scripts (`get-aspire-cli.ps1` and `get-aspire-cli.sh`) need to be signed and published as part of the release process. A new Azure DevOps pipeline is needed to handle this.

## Proposal

Create an AzDO pipeline that:

1. **Signs** the public acquisition scripts:
- `get-aspire-cli.ps1` (Authenticode signing for PowerShell)
- `get-aspire-cli.sh` (GPG or equivalent signing)
2. **Publishes** the signed scripts to:
- Azure DevOps artifacts
- GitHub release assets

### Pipeline behavior

- **Manual trigger only** — this pipeline is not wired into CI or release automation; it is run on-demand.
- **Dry-run mode** — a pipeline parameter (`dryRun` or similar) that performs signing and stages artifacts but skips the actual publish step. This allows validation before committing to a real publish.

### Scope

- Only the **public install scripts** (`get-aspire-cli.ps1` / `get-aspire-cli.sh`) are in scope.
- PR dogfood scripts (`get-aspire-cli-pr.ps1` / `get-aspire-cli-pr.sh`) are out of scope.
- Exact publishing destinations and signing certificate details to be determined during implementation.

## Related

- #14203 — Sign `get-aspire-cli.ps1`
- #15284