Automate Foundry PR governance: duplicate-PR detection and public-docs tracking

## Problem

Two recurring gaps on Azure AI (`azure.ai.*`) extension PRs:

1. **Duplicate work.** The same issue sometimes gets fixed by different people in separate PRs (often from delegating to Copilot). We usually notice only in review, or after both merge.
2. **Docs drift.** User-visible changes (new environment variables, flags, commands) ship without a tracked hand-off to the docs team. Example: #9048 added a routines HTTP timeout environment variable - a clear Microsoft Learn candidate - with no separate work item.

## Proposal

Two gh-aw agentic workflows scoped to `cli/azd/extensions/azure.ai.*`, plus a Copilot code-review backstop:

- **Duplicate PR detector** - on PR open/reopen, comments when the PR likely duplicates an open PR or one merged in the last 14 days (matched by linked issue, overlapping files, or the same feature/bug).
- **Docs tracker** - opens a public-docs tracking issue (labeled `area/public-docs` plus the matching `ext-*`) when a doc-worthy PR opens, then comments on that issue as the PR is rescoped, abandoned, or merged, so the docs team can begin and prioritize the work independently.
- **Backstop** - a scoped `*.instructions.md` so Copilot code review flags doc-worthy `azure.ai.*` changes even when a workflow run is skipped.

Both workflows run read-only through gh-aw safe-outputs with checkout disabled, following the existing Extension PR Labeler security pattern.

Start by reviewing the existing Extension PR Labeler security pattern and the gh-aw safe-outputs approach, with checkout disabled. Then scope the duplicate-PR detector, public-docs tracker, and *.instructions.md backstop to cli/azd/extensions/azure.ai.*. Done means both read-only workflows and the Copilot review backstop cover the proposed PR and documentation hand-offs.

Written by the indexing model from the issue text.