Add Linux Native AOT coverage for signed NuGet package restore

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

#19847 moves bundled NuGet restore into the Native AOT `aspire` CLI and embeds the SDK trusted roots used by NuGet signature verification on Linux. The current Windows validation and unit tests cannot prove that a published Linux Native AOT CLI correctly initializes the Linux trust store and restores a signed package end to end.

### Describe the solution you'd like

Add a dedicated Linux CI or end-to-end scenario that:

1. Publishes or uses the published Native AOT `aspire` CLI for a supported Linux RID.
2. Runs an Aspire operation that restores a signed NuGet package through the in-process NuGet client.
3. Verifies signature validation succeeds using the trusted roots embedded in the CLI.
4. Fails if the trusted-root extraction, NuGet signature-verification initialization, or signed package restore regresses.

The test should exercise the published Native AOT binary rather than only unit-testing the trust-store helper.

### Additional context

This coverage was requested during review of #19847 and intentionally deferred so the restore correctness fixes can remain focused. The Windows Native AOT publish and focused NuGet tests pass, but they do not validate Linux certificate-store behavior.

Start by reading #19847, the existing Windows Native AOT validation, and the focused NuGet tests. Add a Linux scenario that runs the published Native AOT aspire CLI, restores a signed package, and confirms embedded trusted roots enable signature validation; it is done when regressions in trust-store extraction, initialization, or restore fail the scenario.

Written by the indexing model from the issue text.