Improve Aspire 13.5 AppHost discovery and pnpm recovery

[Ella Hathaway (ellahathaway)]

What changed

Improve Aspire 13.5 skill guidance for TypeScript AppHosts and complex JavaScript repositories.

• Use aspire.config.json to find the actual AppHost source file, including nested or custom paths.
• Recognize apphost.run.json as launch metadata rather than an AppHost source file.
• Recover safely when a pnpm workspace policy blocks esbuild during aspire init, without changing the root policy.
• Add first-party Valkey guidance using Aspire.Hosting.Valkey and addValkey.
• Ask users to choose the normal Compose command/profile when several local launch options exist.
• Avoid duplicate resources when Compose and package manifests describe the same application, and exclude docs, tests, E2E, and tooling by default.
• Add eval coverage for these scenarios and migrate changed specs from removed expect_skills constraints to skill-invocation graders.

Validation

• Current @microsoft/vally-cli lint passes for the Aspire, Aspire Init, and Aspireify eval specs.
• A real nested pnpm workspace ran esbuild's postinstall with the scoped allowBuilds policy while the root esbuild: false policy remained unchanged.
• npm test is currently blocked by unrelated Windows/Node 25 telemetry-hook failures.