Azure Government Cloud not supported in provisioning system (ArmClient defaults to Commercial Cloud)

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

When using Aspire 13.4.4 with Azure Government Cloud resources, the provisioning system fails with "SubscriptionNotFound" errors because the `ArmClient` defaults to Azure Commercial Cloud endpoints.

### Expected Behavior

The provisioning system should work with Azure Government Cloud resources when `Azure:Cloud` is configured.

### Actual behavior

**In Run Mode (F5):**
```
Resolving KeyVault as existing resource...
Error provisioning KeyVault.
Azure.RequestFailedException: The subscription 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' could not be found.
Status: 404 (Not Found)
ErrorCode: SubscriptionNotFound

at Azure.ResourceManager.Resources.SubscriptionResource.GetAsync(CancellationToken cancellationToken)
at Azure.ResourceManager.ArmClient.GetDefaultSubscriptionAsync(CancellationToken cancellationToken)
at Aspire.Hosting.Azure.Provisioning.Internal.DefaultArmClientProvider.DefaultArmClient.GetSubscriptionAndTenantAsync(CancellationToken cancellationToken) in /_/src/Aspire.Hosting.Azure/Provisioning/Internal/DefaultArmClientProvider.cs:line 32
```

**In Deploy Mode (`aspire deploy`):**
```
info: Aspire.Hosting.Azure.Provisioning.Internal.DefaultTokenCredentialProvider[0]
Using AzureCliCredential for provisioning.

fail: Aspire.Hosting.Publishing.PipelineExecutor[0]
Step 'create-provisioning-context' failed.
Azure.RequestFailedException: The subscription 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' could not be found.
Status: 404 (Not Found)
ErrorCode: SubscriptionNotFound

at Azure.ResourceManager.ArmClient.GetDefaultSubscriptionAsync(CancellationToken cancellationToken)
at Aspire.Hosting.Azure.Provisioning.Internal.DefaultArmClientProvider.DefaultArmClient.GetSubscriptionAndTenantAsync(CancellationToken cancellationToken) in /_/src/Aspire.Hosting.Azure/Provisioning/Internal/DefaultArmClientProvider.cs:line 32
```

### Steps To Reproduce

1. Configure Azure Government Cloud in user secrets:
```json
{
"Azure": {
"Cloud": "AzureGovernment",
"TenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"SubscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"Location": "usgovvirginia"
},
"Parameters": {
"resourceGroupName": "rg-example-nonprod",
"keyVaultName": "kv-example-dev"
}
}
```

2. Create an AppHost with an existing Azure Key Vault:
```csharp
using Aspire.Hosting.Azure;

var builder = DistributedApplication.CreateBuilder(args);

var resourceGroupName = builder.AddParameter("resourceGroupName");
var keyVaultName = builder.AddParameter("keyVaultName");

var kv = builder.AddAzureKeyVault("KeyVault")
.AsExisting(keyVaultName, resourceGroupName)
.ClearDefaultRoleAssignments();

builder.Build().Run();
```

3. Run with `dotnet run` (F5) or `aspire deploy`

### Exceptions (if any)

Resolving KeyVault as existing resource...
Error provisioning KeyVault.
Azure.RequestFailedException: The subscription 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' could not be found.
Status: 404 (Not Found)
ErrorCode: SubscriptionNotFound

at Azure.ResourceManager.Resources.SubscriptionResource.GetAsync(CancellationToken cancellationToken)
at Azure.ResourceManager.ArmClient.GetDefaultSubscriptionAsync(CancellationToken cancellationToken)
at Aspire.Hosting.Azure.Provisioning.Internal.DefaultArmClientProvider.DefaultArmClient.GetSubscriptionAndTenantAsync(CancellationToken cancellationToken) in /_/src/Aspire.Hosting.Azure/Provisioning/Internal/DefaultArmClientProvider.cs:line 32

### Aspire doctor output

Checking Aspire environment...

Aspire Environment Check
========================

Aspire
✅ Aspire CLI version 13.4.4 (channel: stable)

.NET SDK
✅ .NET 10.0.202 installed (x64)

Container Runtime
✅ Podman v5.8.1: running (auto-detected (only runtime running)) ←
active

Environment
✅ HTTPS development certificate is trusted

Summary: 4 passed, 0 warnings, 0 failed

Aspire CLI Installations
========================

╭─────────────┬─────────────┬─────────────┬─────────────┬─────────────╮
│ Path │ Version │ Channel │ Route │ PATH status │
├─────────────┼─────────────┼─────────────┼─────────────┼─────────────┤
│ C:\Users\jb │ 13.4.4+ccc5 │ stable │ dotnet-tool │ not on PATH │
│ row11\.dotn │ 66c5ab3285c │ │ │ │
│ et\tools\.s │ 9beb8f38ede │ │ │ │
│ tore\aspire │ 34734bb477c │ │ │ │
│ .cli\13.4.4 │ 029 │ │ │ │
│ \aspire.cli │ │ │ │ │
│ .win-x64\13 │ │ │ │ │
│ .4.4\tools\ │ │ │ │ │
│ net10.0\win │ │ │ │ │
│ -x64\aspire │ │ │ │ │
│ .exe │ │ │ │ │
│ (current) │ │ │ │ │
│ C:\Users\jb │ (not │ (not │ (not │ active │
│ row11\.dotn │ probed) │ probed) │ probed) │ │
│ et\tools\as │ │ │ │ │
│ pire.CMD │ │ │ │ │
╰─────────────┴─────────────┴─────────────┴─────────────┴─────────────╯

### Anything else?

### Potential Root Cause

In `DefaultArmClientProvider.cs`, the `ArmClient` is instantiated without specifying an `ArmEnvironment`. The subscription exists in Azure Government Cloud (`management.usgovcloudapi.net`) but the ARM client queries Azure Commercial Cloud (`management.azure.com`) by default.

The `Azure:Cloud` configuration setting is not used when creating the `ArmClient`.

### Environment

- **Aspire Version:** 13.4.4
- **OS:** Windows 11
- **Azure Cloud:** Azure Government (usgovcloudapi.net)
- **Azure CLI Cloud:** AzureUSGovernment
- **Azure CLI Status:** Authenticated and working (`az account show` returns the correct subscription)

### Additional Context

- The Key Vault exists in Azure Government Cloud at `kv-example-dev.vault.usgovcloudapi.net`
- The subscription is valid and accessible via Azure CLI when configured for `AzureUSGovernment`
- Azure CLI is configured with: `az cloud set --name AzureUSGovernment`