azure.ai.agents: reject hosted-only agent fields for non-hosted kinds (schema + runtime)

## Summary

In the `azure.ai.agents` extension, several hosted-agent-only properties are accepted on non-hosted agent kinds (e.g. `kind: prompt-voice`) but are silently dropped during load/deploy conversion, so the configuration validates yet has no effect.

This was surfaced during review of #9612 (adding `sessionConfiguration.idleTimeoutSeconds`), but it is **pre-existing, general behavior** — not specific to that field.

## Affected fields

In `schemas/azure.ai.agent.json` the root is `additionalProperties: true` and the only kind-based conditional is `if kind == prompt-voice → required: ["model"]`. The following hosted-only properties are all unconditional root properties with no kind gating:

- `codeConfiguration`
- `policies`
- `protocols`
- `agentEndpoint`
- `sessionConfiguration`

All of these are dropped by `AgentDefinitionInline.toVoiceAgent()` for voice agents, and are not rejected by `ValidateAgentDefinition` (`internal/pkg/agents/agent_yaml/parse.go`).

> Note: `schemas/Agent.json` (the legacy agents-array schema) already confines these via per-kind `oneOf` branches with `additionalProperties: false`, so this gap is specific to `azure.ai.agent.json`.

## Proposed change

Restrict hosted-only fields to `kind: hosted` **consistently for the whole family**, not just one field:

1. **Schema** (`azure.ai.agent.json`): extend the `allOf` so that when `kind` is not `hosted` (e.g. `prompt-voice`), the hosted-only properties above are disallowed (`properties: { : false }` or equivalent).
2. **Runtime** (`ValidateAgentDefinition`): reject these fields for non-hosted kinds with a clear error. Note the voice unmarshal path currently drops unknown keys before validation, so detecting a stray key requires inspecting the raw YAML map.
3. **Tests**: add schema + runtime rejection cases per field.

## Context

- Discovered in PR #9612 review.
- Deferred from #9612 to keep that PR scoped to issue #9602 (adding the idle timeout) and to fix the whole field family consistently rather than singling out one property.

Start with schemas/azure.ai.agent.json and ValidateAgentDefinition in internal/pkg/agents/agent_yaml/parse.go, then inspect the voice unmarshal path and existing schema tests. Add rejection coverage for each hosted-only field on non-hosted kinds, and verify hosted configurations remain valid while runtime and schema validation report clear errors.

Written by the indexing model from the issue text.