[Issue] azd Continues to Make /me Graph API Call and Prompts for Parameters in Azure DevOps with WIF, Despite principalId Configuration

**Output from `azd version`**
azd version 1.16.0 (commit 29480031d2bcbd20153eaacf97856c9ba2e678de)

**Describe the bug**
**Area:** `azd provision`, Authentication, Azure DevOps Integration
**`azd` version:** 1.16.0 (as per pipeline logs)
**OS:** `ubuntu-latest` (Azure DevOps hosted agent)
**CI/CD System:** Azure DevOps Pipelines
**Authentication Method:** Azure Service Connection with Workload Identity Federation (WIF)

When attempting to deploy a .NET Aspire application to Azure Container Apps using `azd provision` within an Azure DevOps pipeline, `azd` consistently makes a Microsoft Graph API call to the `/me` endpoint. This call fails with a 400 Bad Request (`/me request is only valid with delegated authentication flow`), as expected when authenticating as a Service Principal.

Immediately following this Graph API error, `azd provision` proceeds to prompt for Bicep infrastructure parameters (e.g., "Enter a value for the 'ControlApiConfig' infrastructure parameter:"), even though these parameters are correctly provided via the `AZD_INITIAL_ENVIRONMENT_CONFIG` environment variable.

This behavior occurs despite:
1. The Azure CLI within the `AzureCLI@2` task successfully logging in as the Service Principal via Workload Identity Federation.
2. Successfully running `azd config set auth.useAzCliAuth "true"`.
3. Successfully retrieving the Service Principal's Object ID (`servicePrincipalId`) and setting it in the `azd` environment using `azd env set principalId "YOUR_SPN_OBJECT_ID"`.
4. Ensuring the Service Principal has the "Directory Readers" Azure AD role.
5. The `AZD_INITIAL_ENVIRONMENT_CONFIG` variable being correctly formatted as a JSON string and made available to the `azd provision` command.

The failure of the `/me` call appears to prevent `azd` from correctly consuming parameters from `AZD_INITIAL_ENVIRONMENT_CONFIG`, leading to interactive prompts that break the CI/CD automation.
(or it seems like it at least)

**To Reproduce**
1. **Configure an Azure DevOps Service Connection** using Workload Identity Federation, ensuring the federated credential on the corresponding Azure AD App Registration is correctly set up (verified correct Issuer and Subject for the SPN).
2. **Grant the Service Principal the "Directory Readers" Azure AD role.**
3. **Pipeline Setup:**
* Define pipeline variables for `AZD_ENV_NAME`, `AZURE_LOCATION`, `AZURE_SUBSCRIPTION_ID`.
* **Task 1: PowerShell Task**
* Construct a JSON string containing Bicep parameters (e.g., `{"ControlApiConfig": {"key": "value"}}`).
* Set this JSON string as a pipeline variable (e.g., `AZD_BICEP_PARAMS_JSON`) using `##vso[task.setvariable variable=AZD_BICEP_PARAMS_JSON]...`.
* **Task 2: AzureCLI@2 Task**
* Input `azureSubscription`: Name of the WIF Service Connection.
* Input `addSpnToEnvironment: true`.
* `env:` block to map `AZD_BICEP_PARAMS_JSON` from ADO variable to a bash environment variable.
* **Inline Bash Script:**
1. Install latest `azd` (`curl -fsSL https://aka.ms/install-azd.sh | bash`).
2. Verify Azure CLI login: `az account show` (confirms login as SPN via WIF, `servicePrincipalId` is available).
3. `azd config set auth.useAzCliAuth "true"`.
4. `azd env new "$AZD_ENV_NAME" --subscription "$AZURE_SUBSCRIPTION_ID" --location "$AZURE_LOCATION"`.
5. `azd env select "$AZD_ENV_NAME"`.
6. `azd env set principalId "$servicePrincipalId"` (using the Object ID of the SPN).
7. Verify `AZD_BICEP_PARAMS_JSON` is correctly populated in the script's environment.
8. Execute: `AZD_INITIAL_ENVIRONMENT_CONFIG="$AZD_BICEP_PARAMS_JSON" azd provision --no-prompt --debug`. or simply `azd provision --no-prompt` (gives the same issue)

**Actual Behavior (Key Log Snippets):**

```log
# ... azd provision execution ...
RESPONSE 400: 400 Bad Request
ERROR CODE: BadRequest
--------------------------------------------------------------------------------
{
"error": {
"code": "BadRequest",
"message": "/me request is only valid with delegated authentication flow.",
"innerError": { /* ... */ }
}
}
--------------------------------------------------------------------------------

# Immediately followed by:
ERROR: initializing provisioning manager: prompting for value: no default response for prompt 'Enter a value for the 'ControlApiConfig' infrastructure parameter:'
```

**Expected behavior**
1. `azd`, when configured with `auth.useAzCliAuth="true"` and having `principalId` set in its environment, should recognize it's running as a Service Principal and **not** attempt to call the `/me` Graph API endpoint.
2. `azd provision` should successfully consume the parameters provided via the `AZD_INITIAL_ENVIRONMENT_CONFIG` environment variable without prompting.
3. The provisioning process should proceed based on the Bicep templates and provided parameters.

**Environment**
* **Azure Developer CLI (`azd`) version:** 1.16.0 (commit `29480031d2bcbd20153eaacf97856c9ba2e678de`)
* **.NET Aspire SDK version:** `9.2.0` (from `Aspire.AppHost.Sdk`)
* **Target Deployment Platform:** Azure Container Apps (ACA)
* **Application Type:** .NET Aspire application (containerized)
* **CI/CD System:** Azure DevOps Pipelines
* **Pipeline Agent OS:** `ubuntu-latest` (Linux)
* **Authentication Method:** Azure DevOps Service Connection with Workload Identity Federation (WIF)
* **Infrastructure as Code (IaC) Tool (managed by `azd`):** Bicep (generated by `azd` from .NET Aspire manifest)
* **Development Language (App):** C# / .NET (version can be added if known, e.g., .NET 8)

**Troubleshooting Steps Taken (Unsuccessful in Preventing the `/me` call and subsequent prompt):**

* Rigorous verification of WIF Service Connection setup in Azure DevOps and corresponding Federated Credential on Azure AD App Registration (correct Issuer, Subject, Audience).
* Confirmed Service Principal has "Directory Readers" Azure AD role and appropriate RBAC (Contributor) on the target subscription.
* Ensured `servicePrincipalId` (Object ID) is correctly retrieved and used for `azd env set principalId`.
* Confirmed `AZD_INITIAL_ENVIRONMENT_CONFIG` is correctly formatted JSON and made available as an environment variable to the `azd provision` command. Tested with minimal and complex JSON structures.
* Varied the order of `azd config set auth.useAzCliAuth "true"` and `azd env set principalId`.
* Ensured the Azure CLI within the `AzureCLI@2` task is successfully logged in as the correct Service Principal via WIF *before* any `azd` commands are run.
* Attempted `azd auth login --client-id "$ARM_CLIENT_ID" --federated-credential-provider "azuredevops" ...` which led to interactive browser login attempts in the pipeline.
* Tested various methods of passing the `AZD_INITIAL_ENVIRONMENT_CONFIG` to the bash script and the `azd provision` command.

**Additional context**
This issue currently blocks our ability to automate .NET Aspire application deployments to Azure Container Apps using `azd` in Azure DevOps pipelines. The core problem seems to be `azd` not fully respecting its non-interactive, Service Principal-driven context early enough in its execution to prevent the problematic `/me` call, which subsequently appears to disrupt its ability to process Bicep parameters from the environment.

The azure.yaml file being used:
```yaml
name: MyApplicationName
services:
app:
project: ./src/Aspire/Aspire.ServiceDefaults/Aspire.ServiceDefaults.AppHost/Aspire.ServiceDefaults.AppHost.csproj
language: dotnet
host: containerapp
```