Investigate and Track Addition of Azure Skills Plugin (@microsoft/azure-skills)

## Summary
Investigate integration of the [@microsoft/azure-skills](https://github.com/microsoft/azure-skills) plugin into the git-ape platform engineering framework, ensuring behavioral consistency across all supported runtimes.

Today, git-ape is packaged as a Copilot CLI plugin with custom agents and skills under `.github/` (see [`plugin.json`](https://github.com/Azure/git-ape/blob/main/plugin.json) and the [Included Components section of the README](https://github.com/Azure/git-ape/blob/main/README.md#L229-L260)). Bringing in `@microsoft/azure-skills` needs to be evaluated against this existing skill surface to avoid duplication and drift.

Notably, `@microsoft/azure-skills` ships multi-runtime manifests (`.claude-plugin`, `.cursor-plugin`, `gemini-extension.json`, `plugin.json`, `.mcp.json`) which is directly relevant to the runtime-consistency goal.

## Context / Current State

- **git-ape plugin manifest**: [`plugin.json`](https://github.com/Azure/git-ape/blob/main/plugin.json)
- **Existing git-ape skills** under `.github/skills/`:
`azure-naming-research`, `azure-resource-availability`, `azure-security-analyzer`, `azure-deployment-preflight`, `azure-role-selector`, `azure-cost-estimator`, `azure-drift-detector`, `azure-integration-tester`, `azure-resource-visualizer`, `git-ape-onboarding` (see [README.md#L129-L141](https://github.com/Azure/git-ape/blob/main/README.md#L129-L141)).
- **Agents** under `.github/agents/` orchestrate these skills (see [README.md#L229-L246](https://github.com/Azure/git-ape/blob/main/README.md#L229-L246)).
- **Execution modes** ([README.md#L212-L214](https://github.com/Azure/git-ape/blob/main/README.md#L212-L214)):
- **Interactive** — VS Code Copilot Chat with `az login`
- **Headless** — Copilot Coding Agent + CI workflows (`git-ape-plan.yml`, `git-ape-deploy.yml`, `git-ape-destroy.yml`, `git-ape-verify.yml`)

## Candidate Skills from `@microsoft/azure-skills`

Full inventory from [microsoft/azure-skills/skills/](https://github.com/microsoft/azure-skills/tree/main/skills), mapped to the git-ape deployment lifecycle:

### Strong candidates (fill gaps in git-ape today)

| Upstream skill | Purpose (candidate fit) | git-ape stage |
|---|---|---|
| [`azure-prepare`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-prepare) | Prerequisite / environment prep | Complements `/prereq-check` |
| [`azure-validate`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-validate) | Template / config validation | Stage 2 (Template & Analysis) |
| [`azure-deploy`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-deploy) | Deployment execution | Stage 3 (Resource Deployer) |
| [`azure-diagnostics`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-diagnostics) | Post-deploy diagnostics / troubleshooting | Stage 4 (Validate) — **new capability** |
| [`azure-upgrade`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-upgrade) | Resource/SDK upgrade guidance | Operations — **new capability** |
| [`azure-cloud-migrate`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-cloud-migrate) | Migration to Azure | Onboarding — **new capability** |
| [`azure-compliance`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-compliance) | Compliance checks | Security gate — complements `azure-security-analyzer` |
| [`azure-enterprise-infra-planner`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-enterprise-infra-planner) | Landing-zone / enterprise infra planning | Stage 1 (Requirements) — **new capability** |
| [`entra-app-registration`](https://github.com/microsoft/azure-skills/tree/main/skills/entra-app-registration) | Entra app/SP creation | Onboarding — overlaps with `git-ape-onboarding` OIDC flow ([docs/ONBOARDING.md](https://github.com/Azure/git-ape/blob/main/docs/ONBOARDING.md)) |

### Direct overlap (evaluate replace vs. coexist)

| Upstream skill | Existing git-ape skill | Action to decide |
|---|---|---|
| [`azure-cost`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-cost) | `azure-cost-estimator` | Keep upstream, deprecate local? |
| [`azure-rbac`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-rbac) | `azure-role-selector` | Merge or delegate |
| [`azure-quotas`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-quotas) | `azure-resource-availability` (SKU/quota) | Split responsibilities |
| [`azure-resource-visualizer`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-resource-visualizer) | `azure-resource-visualizer` | **Name collision** — must resolve |
| [`azure-resource-lookup`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-resource-lookup) | (partial: IaC Exporter agent) | Complementary |

### Workload-specific skills (opt-in per deployment)

| Upstream skill | Use case in git-ape |
|---|---|
| [`azure-compute`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-compute) | VM / compute deployments |
| [`azure-kubernetes`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-kubernetes) | AKS deployments |
| [`azure-storage`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-storage) | Storage accounts |
| [`azure-messaging`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-messaging) | Service Bus / Event Grid / Event Hubs |
| [`azure-kusto`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-kusto) | ADX / Kusto workloads |
| [`azure-ai`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-ai) | Azure AI services |
| [`azure-aigateway`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-aigateway) | AI gateway pattern |
| [`microsoft-foundry`](https://github.com/microsoft/azure-skills/tree/main/skills/microsoft-foundry) | Foundry-based agent workloads |
| [`azure-hosted-copilot-sdk`](https://github.com/microsoft/azure-skills/tree/main/skills/azure-hosted-copilot-sdk) | Hosted Copilot SDK apps |
| [`appinsights-instrumentation`](https://github.com/microsoft/azure-skills/tree/main/skills/appinsights-instrumentation) | App Insights wiring → pairs with `azure-integration-tester` |

## Investigation Tasks

### 1. Scope & overlap analysis
- Validate the tables above against the final upstream skill contracts.
- For each direct-overlap skill, decide: **adopt upstream**, **keep local**, or **delegate** (local skill calls upstream).
- Resolve the `azure-resource-visualizer` name collision.

### 2. Packaging & plugin manifest
- Determine distribution: upstream ships `plugin.json`, `.mcp.json`, `.claude-plugin`, `.cursor-plugin`, `gemini-extension.json` — pick the right surface for git-ape (Copilot CLI plugin and/or MCP).
- Define how it's declared in [`plugin.json`](https://github.com/Azure/git-ape/blob/main/plugin.json) and [`.github/plugin/marketplace.json`](https://github.com/Azure/git-ape/blob/main/.github/plugin/marketplace.json).
- Assess impact on `copilot plugin install Azure/git-ape` ([README.md#L45-L71](https://github.com/Azure/git-ape/blob/main/README.md#L45-L71)).

### 3. Runtime consistency
Validate identical behavior across all three runtimes:

| Runtime | Entry point | Things to verify |
|---|---|---|
| **Local (VS Code Copilot Chat)** | `@git-ape ...` in chat | Skill discovery, `az login` auth, Azure MCP interaction ([AZURE_MCP_SETUP.md](https://github.com/Azure/git-ape/blob/main/docs/AZURE_MCP_SETUP.md)) |
| **Local in CLI** (`copilot` CLI) | `copilot plugin install Azure/git-ape` | Skill invocation parity, auth via `az`/`gh`, prereq-check compatibility |
| **Copilot Coding Agent (headless)** | GitHub issue → PR → `git-ape-*.yml` workflows | OIDC auth (not `az login`), non-interactive skill execution, workflow integration |

### 4. Authentication & permissions
- Confirm upstream skills work with `az login` (interactive) **and** OIDC-based auth in Actions (see [docs/ONBOARDING.md#L290-L314](https://github.com/Azure/git-ape/blob/main/docs/ONBOARDING.md#L290-L314)).
- Verify RBAC (Contributor / User Access Administrator) compatibility.
- Check `entra-app-registration` co-existence with existing onboarding script.

### 5. Prerequisite & environment parity
- Update `/prereq-check` for any new dependencies.
- Extend `.devcontainer/` and Codespaces ([docs/CODESPACES.md#L66-L81](https://github.com/Azure/git-ape/blob/main/docs/CODESPACES.md#L66-L81)) as needed.

### 6. Orchestration impact
- Slot new skills into the deployment flow ([README.md#L147-L167](https://github.com/Azure/git-ape/blob/main/README.md#L147-L167)); re-evaluate the security gate with `azure-compliance`.
- Preserve invocation syntax (`/skill-name`) and agent delegation patterns.

## Acceptance Criteria

- [ ] Finalized overlap/gap matrix (replace / coexist / adopt) for every upstream skill.
- [ ] Decision recorded: dependency vs. embed vs. partial adoption.
- [ ] PoC integration validated in **all three** runtimes (local VS Code, local CLI, Copilot Coding Agent).
- [ ] Auth verified with both `az login` and OIDC.
- [ ] Name collision on `azure-resource-visualizer` resolved.
- [ ] No regression in `git-ape-plan` → `git-ape-deploy` → `git-ape-verify` → `git-ape-destroy`.
- [ ] Updates to `plugin.json`, `marketplace.json`, README, and prereq-check as needed.
- [ ] Follow-up implementation issues filed.

## References
- Upstream plugin: https://github.com/microsoft/azure-skills (skills dir: https://github.com/microsoft/azure-skills/tree/main/skills)
- git-ape plugin manifest: [`plugin.json`](https://github.com/Azure/git-ape/blob/main/plugin.json)
- git-ape README: [`README.md`](https://github.com/Azure/git-ape/blob/main/README.md)
- Azure MCP setup: [`docs/AZURE_MCP_SETUP.md`](https://github.com/Azure/git-ape/blob/main/docs/AZURE_MCP_SETUP.md)
- Onboarding / OIDC: [`docs/ONBOARDING.md`](https://github.com/Azure/git-ape/blob/main/docs/ONBOARDING.md)
- Codespaces: [`docs/CODESPACES.md`](https://github.com/Azure/git-ape/blob/main/docs/CODESPACES.md)