fix: load plugin market key from desktop assets

[PANDAJSR]

Summary

• Load Assets/Plugins/plugin-market-public-key.txt from the desktop output directory when desktop assets are not embedded in SecRandom.dll.
• Keep the existing avares:// lookup for bundled mobile/non-desktop builds.

Root cause

Desktop builds set SecRandomBundleAssetsInAssembly=false, so the market public key is copied beside the executable rather than embedded as an Avalonia resource. PluginMarketService only tried avares://..., causing index signature verification to fail and leaving the market list empty.

The official market index already contains secrandom.secagent; this fixes the desktop client loading it.

Validation

• git diff --check passed.
• The separate worktree NuGet restore was attempted but timed out while contacting external package sources.

[PANDAJSR]

已由组合修复 PR #269 包含，关闭重复 PR。