[Module Proposal]: `avm/res/app/agent`

### Check for previous/existing GitHub issues/module proposals

- [x] I have checked for previous/existing GitHub issues/module proposals.

### Check this module doesn't already exist in the module indexes

- [x] I have checked for that this module doesn't already exist in the module indexes.

### Bicep or Terraform?

Bicep

### Module Classification?

Resource Module

### Module Name

avm/res/app/agent

### Module Details

# Module Proposal: `avm/res/app/agent`

## Module Details

| Field | Value |
|---|---|
| **Resource Provider** | `Microsoft.App/agents` |
| **API Version** | `2025-05-01-preview` |
| **Module Classification** | Resource Module |
| **Language** | Bicep |
| **Module Owner** | [@FallenHoot](https://github.com/FallenHoot) |

## Description

AVM resource module for Azure SRE Agent — an AI-powered site reliability engineering agent that monitors, diagnoses, and resolves Azure infrastructure issues. The agent operates in configurable modes (Review, Autonomous, ReadOnly) with access levels (High, Low) and integrates with Azure Monitor for incident management.

Example: https://github.com/microsoft/sre-agent/blob/main/samples/bicep-deployment/bicep/sre-agent-resources.bicep

## AVM Interfaces Implemented

- ✅ Managed Identity (system + user-assigned)
- ✅ Resource Lock
- ✅ Role Assignments
- ✅ Diagnostic Settings (metrics)
- ✅ Telemetry

## Built-in Roles

| Role | Role Definition ID |
|---|---|
| Contributor | `b24988ac-6180-42a0-ab88-20f7382dd24c` |
| Owner | `8e3af657-a8ff-443c-a75c-2fe8c4bcb635` |
| Reader | `acdd72a7-3385-48ef-bd42-f606fba81ae7` |
| RBAC Administrator | `f58310d9-a9f6-439a-9e8d-f62e7b41a168` |
| User Access Administrator | `18d7d88d-d35e-4fb5-a5c3-7773c20a72d9` |
| SRE Agent Administrator | `e79298df-d852-4c6d-84f9-5d13249d1e55` |

## Test Scenarios

| Scenario | Description |
|---|---|
| `defaults` | Minimal required parameters only |
| `max` | Full parameters including Managed Identity, Lock, Role Assignments, and Application Insights |
| `waf-aligned` | Security-focused configuration aligned with Well-Architected Framework |

## Note

> This resource is currently in **preview** (`2025-05-01-preview`). The module is fully implemented and passes **99/100** Pester tests (1 expected failure: AVM CSV not yet registered).

## PR Ready

> Branch: [`FallenHoot/bicep-registry-modules`](https://github.com/FallenHoot/bicep-registry-modules) — `avm-res-sre-agent`

### Do you want to be the owner of this module?

Yes

### Module Owner's GitHub Username (handle)

FallenHoot

### (Optional) Secondary Module Owner's GitHub Username (handle)

_No response_