Follow up: NativeAOT dotnet-tool packaging hardening tasks

## Background

This is the umbrella follow-up issue for the NativeAOT `dotnet tool` work in #16496.

The PR ships the Aspire CLI as RID-specific NativeAOT `dotnet tool` packages while preserving the existing native archive distribution path. During the work, we found a few hardening items that are better tracked separately from the initial shipping PR.

## Follow-up tasks

- [ ] #16543
- [x] Track restructuring dotnet-tool packing so the Aspire binary is signed once, then both the native archive and dotnet-tool nupkg are produced from that signed binary.
- [ ] Harden daily CLI smoke dotnet-tool feed configuration so `tests/Shared/Docker/NuGet.DotnetTool.config` stays in sync with the relevant root `NuGet.config` package sources.

## Daily smoke feed configuration task

PR #16501 added daily CLI smoke coverage for installing Aspire.Cli through the `dotnet tool` path. That path uses `tests/Shared/Docker/NuGet.DotnetTool.config` inside the Docker E2E image so prerelease/internal packages can resolve from the expected feeds.

The Docker-specific NuGet config currently duplicates a subset of package source entries from the root `NuGet.config`. The root config can be updated by Dependency Flow, so the Docker config can silently drift unless we add an enforcement mechanism.

Tasks:

- [ ] Address PR feedback from #16501 by adding a real enforcement mechanism for `tests/Shared/Docker/NuGet.DotnetTool.config` staying in sync with the relevant root `NuGet.config` package sources.
- [ ] Decide whether to generate the Docker NuGet config from the canonical root `NuGet.config`, or add a CI/test check that compares the relevant `` package source entries.
- [ ] Keep the Docker config package source mappings intentionally narrow for the dotnet-tool smoke path.
- [ ] Update any comments or docs so future feed changes point at the enforcement mechanism instead of relying on manual review.
- [ ] Validate the daily smoke dotnet-tool install path after the enforcement change.

Relevant files:

- `NuGet.config`
- `tests/Shared/Docker/NuGet.DotnetTool.config`
- `tests/Shared/Docker/Dockerfile.e2e`
- `.github/workflows/tests-daily-smoke.yml`