Move the azd ${VAR} reference scanner into pkg/foundry

Follow-up from review on #9367.

## Context

`FindEnvReferences` / `ValidateEnvReferences` are the single scanner for azd `${VAR}` references in a Foundry value. They answer, for a given string, exactly which occurrences `foundry.ExpandEnv` will act on: `$$` escapes are collapsed, `${{...}}` spans are reserved (detected by substituting a per-occurrence probe and letting `ExpandEnv` report which probes it left alone), balanced `:-` defaults are walked, and anything outside `${VAR}` / `${VAR:-default}` / `$${VAR}` / `${{...}}` is rejected so the scan stays complete against drone/envsubst's wider grammar.

Three consumers need that answer:

- `azure.ai.agents/internal/cmd` — init prompting and the generated service env block
- `azure.ai.agents/internal/synthesis` — `resolveVars`' unresolved-variable guard
- `azure.ai.projects/internal/synthesis` — same code, byte-identical copy

## Problem

The natural home is `cli/azd/pkg/foundry`, next to `ExpandEnv`, whose behavior it models. That was the reviewer's ask on #9367.

It cannot go there yet. Both extensions consume azd core at a pinned release (`github.com/azure/azure-dev/cli/azd v1.28.0`, with core currently at 1.30.0-beta.1) and neither carries a `replace`, so new `pkg/foundry` API is not visible to them until core ships and both `go.mod` files are bumped — the two-PR rule in `cli/azd/AGENTS.md`.

#9367 therefore homed it in `internal/synthesis`, which is the one import path the two byte-identical synthesizer copies and `internal/cmd` can all spell identically (`parity_test.go` compares the non-test `.go` files byte for byte, so a module-qualified import such as `azureaiagent/internal/pkg/envrefs` would break parity). That gives one implementation today, in a package whose doc comment is about ARM synthesis.

## Proposed work

1. Move `envrefs.go` to `cli/azd/pkg/foundry` (exported as `foundry.FindEnvReferences` / `foundry.ValidateEnvReferences`), with its tests.
2. Ship a core release.
3. `go get github.com/azure/azure-dev/cli/azd && go mod tidy` in both extensions, delete both `internal/synthesis/envrefs.go` copies and the `internal/cmd/env_refs.go` adapter, and point all callers at `pkg/foundry`.

Step 3 also removes the layering wart where `internal/cmd` imports `internal/synthesis` purely for the scanner, which matters when `internal/synthesis` leaves `azure.ai.agents` at the end of the staged ownership migration.