[EPIC] Support Foundry extension(s) and CLI scenarios

## Problem statement

Azure AI Foundry provides rich capabilities through its portal and SDKs. The Foundry extension brings those capabilities to the terminal, giving developers who prefer CLI-first workflows (or need automation for CI/CD) a native azd experience for managing models, skills, and agents. This extension also serves as the first high-value, first-party extension built on the azd extension framework, validating the framework for the broader ecosystem.

## Vision

A first-party Foundry extension, built on the azd extension framework, that gives developers CLI access to core Foundry scenarios: model and capacity resolution, skill creation and management, and cross-tenant support. This is both a developer productivity win and the proof point that the extension framework is real.

## Who this helps

- **Foundry users** who work with Azure AI Foundry for model deployment, agent hosting, and skill management, and who want to do it all from the terminal with model/capacity resolution that just works and cross-tenant support for enterprise scenarios.
- **Extension developers** who can use the Foundry extension as a reference implementation. If the framework works for a complex first-party extension, it'll work for their use case too.
- **Platform engineers** who need Foundry CLI workflows that can be scripted and integrated into CI/CD pipelines, with cross-tenant support for enterprise environments.
- **Azure developers building AI agents** who benefit from Foundry extension capabilities feeding into the `azd ai` experience, making agent workflows richer.

## Goals (in scope)

- **First-party Foundry extension** built entirely on the azd extension framework, with no special internal APIs or shortcuts
- **Skill creation and management** via CLI: create, list, update, and attach skills to agents without the portal
- **Model and capacity resolution**: Intelligent selection of models and compute based on availability, quota, and developer intent
- **Cross-tenant support**: Enterprise developers working across Azure AD tenants can use Foundry through azd without auth gymnastics

## Non-goals (out of scope)

- **Replacing the Foundry portal or SDK**: azd is the CLI entry point for developers who prefer the terminal. The portal and SDK remain the full-featured surfaces.
- **Owning Foundry platform features**: azd surfaces Foundry capabilities; we don't build or maintain the underlying platform.
- **Full Foundry API coverage**: We prioritize the highest-value CLI scenarios, not 1:1 API parity.

## Success criteria

- [ ] Foundry extension installable and functional through the azd extension framework (no sideloading)
- [ ] Skill creation flow works end-to-end: create skill → attach to agent → invoke agent with skill
- [ ] Model and capacity resolution handles common scenarios: region fallback, quota limits, model availability
- [ ] Cross-tenant authentication works for at least the top 2 enterprise patterns (multi-tenant app, B2B guest)
- [ ] Extension serves as a documented reference implementation for 3rd-party extension developers
- [ ] No internal-only APIs used; everything goes through the public extension framework

## Dependencies

- **Extension Framework GA**: The Foundry extension can't ship on a framework that isn't stable. API freeze (April) is the minimum gate. See [Extension Framework GA](extension-framework-ga.md).
- **`azd ai` GA**: Agent lifecycle commands must be stable before Foundry-specific scenarios layer on top. See [Hosted Agents CLI](hosted-agents-cli-ga.md).
- **Azure AI Foundry platform team**: API availability for skill management, model resolution, and cross-tenant scenarios. azd can only surface what the platform exposes.
- **Azure identity team**: Cross-tenant auth patterns and any MSAL/identity library support needed.