[Initiative] 🪼 Enable developer to build workflows

## Problem statement

`azd` already supports the core developer workflow from init to deploy. This pillar extends that into three areas: making `azd` extensible so anyone can add capabilities, supporting a complete CLI workflow for AI agent lifecycle management, and keeping developers current with safe, opt-in updates.

There are clear opportunities here. Extension developers can get stable APIs and a Go SDK instead of scripting. AI agent developers can get a seamless flow from `azd ai agent init` to deploy to invoke, all in one tool. And an insiders channel with `azd update` can give power users early access to new features with rollback protection.

This epic is focused on GA-quality for the extension framework and expanding the extensibility model framework and tooling for builders.

## Vision

`azd` becomes the complete developer workflow surface for Azure: extensible by anyone, purpose-built for AI agent development, and always up to date. A developer can `azd init`, build an extension, build an agent, `azd up`, and be in production in minutes, as well as customize their engineering teams' custom workflows.

## Who this helps

- **Developers building AI agents** get a seamless flow from `azd ai agent init` to `azd ai agent deploy` to `azd ai agent invoke`, with interactive REPL chat and streaming responses. Example: go from an idea to a running hosted agent in under 5 minutes without leaving the terminal.
- **Extension developers** get stable, documented APIs with a Go SDK and a clear submission pipeline. Any gRPC language works. Example: build a custom provisioning extension, test it locally, submit it, and others can `azd extension install` it.
- **Developers using Azure AI Foundry** can manage models, skills, and agents through CLI-first workflows without switching to the portal. Example: `azd ai agent deploy` handles container optimization, model resolution, and deployment in one command.
- **Power users and early adopters** get an insiders channel for bleeding-edge features, with crash-loop guards, version pinning, and rollback so things don't break silently.
- **Teams standardizing on `azd`** get `azd update` with opt-in auto-updates, version pinning, and safety guarantees so controlled rollouts are straightforward.

## Goals (in scope)

- Ship the **extension framework as GA**: stable APIs, Go SDK, 3rd-party submission pipeline, documentation
- Ship **`azd ai` commands as GA**: full agent lifecycle from init to invoke in < 5 minutes
- Deliver **first-party Foundry extension(s)** built on the extension framework, proving the extensibility model
- Launch **insiders channel and `azd update`**: safe, opt-in auto-updates with rollback protection

## Non-goals (out of scope)

- Building the hosted agents platform; `azd` is the CLI surface, not the backend
- SDKs for every gRPC language on day one; Go is first-class, others on demand
- Replacing the Foundry portal or SDK; `azd` is the CLI entry point
- Forced auto-updates; always opt-in, always recoverable

## Success criteria

- [ ] Extension framework reaches GA with stable APIs and documentation
- [ ] `azd ai` commands reach GA with a complete agent lifecycle (init, deploy, invoke, down)
- [ ] Init-to-running-agent time < 5 minutes (measured end-to-end)
- [ ] First-party Foundry extension built and working on the framework
- [ ] 3rd-party extension submission pipeline operational with at least one external submission
- [ ] Insiders channel active with early adopters providing pre-release feedback
- [ ] `azd update` command works with opt-in auto-update and rollback/recovery

## Dependencies

- **Azure AI Foundry team**: Platform APIs for agent hosting, model deployment, capacity resolution
- **Azure Dev Tools (Pillar 2)**: Coordination on `azd tool` so updates feel cohesive
- **Security/signing**: Extension signing infrastructure for 3rd-party submissions