Harden NativeAOT CLI signing glob

Follow-up from NativeAOT dotnet-tool packaging review in #16496.

José flagged that the NativeAOT CLI signing glob is broader than intended and can match intermediate AOT/linker outputs rather than only the binary that actually ships.

Review thread: https://github.com/microsoft/aspire/pull/16496#discussion_r3157783043
Umbrella: #16542

Tasks:

- [ ] Decide whether the standalone NativeAOT CLI `ItemsToSign` entry is still needed now that the native archive payload is signed through container signing.
- [ ] If standalone signing is still needed, scope it to the actual staged shipping binary path rather than broad `Aspire.Cli.*\**\aspire(.exe)` matches.
- [ ] Validate the selected path in an AzDO binlog by confirming the expected `ItemsToSign` entry is present and intermediate native/linker outputs are not included.