[Skill Bug]: Deployment scenario taking too many attempts

### Preflight Checklist

- [x] I have installed the [latest version of GitHub Copilot for Azure in VS Code](https://github.com/microsoft/GitHub-Copilot-for-Azure/releases/latest).
- [x] I have checked existing resources, including using the /help command in the chat window.
- [x] I have searched for [similar issues](https://github.com/microsoft/GitHub-Copilot-for-Azure/issues).

### Repro Steps

1. Clone this repo: https://github.com/charris-msft/zava_photo_uploader
2. Open Copilot CLI
3. Add the Azure Skills Plugin to Copilot CLI
4. run `/mcp reload` to load the mcp servers
5. submit the prompt

### Prompt

Help me deploy this application to Azure

### Expected Result

The simple application deploys smoothly in without any need to troubleshoot

### Actual Result

## Opus 4.6
Storage account access key policy error - didn't call policy tool, but did see those instructions in best practices when asked.

## Sonnet 4.6
Here are the 4 fix loops in order:

Fix 1 — azure.yaml missing language field
ERROR: must specify language or image
The generated azure.yaml had host: containerapp but no language field. AZD 1.23.5 requires it even when you're using Docker. Added language: python.

Fix 2 — Interactive prompt blocked --no-prompt
azd provision --preview --no-prompt hung waiting for input. Because infra/main.bicep uses targetScope = 'resourceGroup', AZD needed a resource group name and dropped into an interactive prompt — which --no-prompt can't satisfy. Fixed by setting $env:AZURE_RESOURCE_GROUP = 'rg-zava-photo-uploader'.

Fix 3 — Azure policy denied shared key access on Storage
ERROR: Policy disallows resource: allowSharedKeyAccess must be false
The subscription has a "Safe Secrets Standard" deny policy requiring allowSharedKeyAccess: false on all Storage accounts. The generated Bicep omitted this property (it defaults to true). Added allowSharedKeyAccess: false to the storage resource.

Fix 4 — Wrong Docker context path in azure.yaml
azd package failed because Docker couldn't find the context. The original config had:
project: ./src
docker:
path: ./src/Dockerfile
context: ./src
AZD resolves docker.path and docker.context relative to project:, so the effective path became ./src/./src — doesn't exist. Fixed to:
docker:
path: Dockerfile
context: .

---------------------------------------------------------------------------------

Fixes 1, 2, and 4 are generation mistakes — wrong defaults or undocumented AZD behavior. Fix 3 is an environment awareness gap — the subscription policy was discoverable before writing any Bicep if the model had used the Policy tool in the Azure MCP but wasn't checked.

### Attachments

_No response_

### Regression?

_No response_

### Additional Context

_No response_