Unable to Deploy SPFx Agent to a Single SharePoint Site (Works Only with Tenant-Wide Deployment)

I have developed an SPFx Application Customizer that hosts a Copilot/Agent sidebar in SharePoint.

Scenario 1: Tenant-Wide Deployment (Works)

When I upload the .sppkg package and select "Enable this app and add it to all sites":

The extension is automatically added to Tenant-Wide Extensions.
I configure the following properties:
Client App ID
Tenant ID
Redirect URL
The bot icon appears in SharePoint.
The agent connects successfully and works as expected.

However, because the deployment is tenant-wide, the bot icon also appears on all other SharePoint sites, which is not my requirement.

Scenario 2: Single Site Deployment (Fails)

When I upload the same .sppkg package and select "Only enable this app":

No entry is created in Tenant-Wide Extensions.
The app is available on the target SharePoint site.
The agent attempts to connect but fails with the error:
Plain Text
Unable to Acquire Token

Show more lines
Troubleshooting Attempted

1. Set skipFeatureDeployment to false
   JSON
   {

"skipFeatureDeployment": false

}

Result: No change.

2. Register the Application Customizer manually using PnP PowerShell
   PowerShell
   Add-PnPCustomAction `

-ClientSideComponentId 4c6e29f2-7eee-4f9f-bbd2-20c8859d0ba2 `

-ClientSideComponentProperties '{"appClientId":"...","tenantId":"...","directConnectUrl":"..."}' `

-Location ClientSideExtension.ApplicationCustomizer `

-Name "SidebarAgent" `

-Title "SidebarAgent" `

-Scope Web

Show more lines

Result: The agent still fails with "Unable to Acquire Token".

even MS support team suggest to delete or remove the ClientSideInstance.xml file and build the solution package. i Did same but result is same

Questions
Why does token acquisition work when the extension is deployed tenant-wide but fail when deployed to a single site?
Is there any additional configuration required for site-scoped deployment?
What is the recommended approach to deploy an SPFx Application Customizer/Agent to only one SharePoint site?
Has anyone successfully implemented a single-site deployment for a similar SPFx-based agent?
Expected Behavior

The agent should be available and functional only on the target SharePoint site, without appearing on other sites across the tenant.

Compare the tenant-wide and single-site .sppkg deployment settings, including skipFeatureDeployment and ClientSideInstance.xml, and review the PnP PowerShell custom action configuration. Reproduce both deployment paths and trace where token acquisition differs; done means the agent authenticates on the target site without appearing on other sites.