Improve internal Microsoft user telemetry

## Summary

Track improvements to the Aspire CLI telemetry that detects Microsoft-internal users and captures a canonical internal alias.

The first 28 days of production telemetry, including the Aspire CLI 13.5 GA rollout, show that positive detection is working but reveal observability, consistency, and platform-coverage gaps:

- Negative detection and detector failures are indistinguishable because the internal tag is only emitted for positive results.
- Only 41% of positively detected 13.5 GA devices emitted an alias.
- Probe completion order can change the selected source and cached result.
- Aliases are not consistently canonical across sources.
- VS Code raw database scanning can merge storage keys with account values; see #19644.
- macOS Platform SSO has produced no observed positive results.
- Native Linux detection coverage is substantially lower than Windows and macOS.
- CI can report aliases that identify automation accounts rather than people.
- Event-weighted metrics substantially overstate alias coverage compared with device-weighted metrics.

## Goals

- Make detector success, negative results, failures, cache behavior, and probe health measurable without collecting additional identity data.
- Produce deterministic detection results and source attribution.
- Emit the same canonical alias for a user regardless of detection source.
- Ensure aliases are structurally bound to the evidence proving Microsoft-internal status.
- Improve platform-specific detector reliability and make regressions visible.

## Work items

- [x] #19646
- [x] #19651
- [x] #19647
- [x] #19648
- [x] #19644
- [x] #19649
- [ ] #19650
- [ ] #19652

The first five issues above are planned for the initial implementation PR. The macOS, Linux, and dashboard items remain tracked for follow-up because they require manual platform validation, security/design work, or the new telemetry schema.

## Privacy and security constraints

Telemetry must not contain tokens, raw account-store data, file paths, exception messages, or uncanonicalized identity values. Any additional local credential-store access or subprocess execution requires security review.