[Epic] Execute tool-driven workflows deterministically and recover safely

## Summary

Tracking issue for converting regular, well-defined series of steps in the skills into reusable bash/PowerShell scripts.

Copilot identified several portions of these skills that are good candidates for replacement with scripts — deterministic, output-heavy, or repeated step sequences. Each subtask below covers one candidate.

## Why

Replacing a regular series of steps with a script reduces token usage and improves the reliability, determinism, and speed of execution of skills. The agent invokes one script and reads a compact, self-describing result instead of generating commands and parsing large output inline on every run.

## Subtasks

### `foundry-agent/deploy/deploy.md`

- [ ] #2466 — RBAC check-and-assign
- [ ] #2467 — Local Docker build / tag / push sequence
- [ ] #2468 — Dataset blob download loop
- [ ] #2469 — ACR build run-status polling
- [ ] #2470 — Environment-variable scan
- [ ] #2471 — Playground `encodedSubId` computation

### `microsoft-foundry/SKILL.md` (Common Project Context Resolution)

- [ ] #2474 — Agent root / azd discovery (Step 1)
- [ ] #2473 — azd context resolution (Step 2)
- [ ] #2476 — Metadata file selection + environment enumeration (Step 3)
- [ ] #2475 — eval.yaml parsing (Step 4)

### `azure-prepare` skill

- [ ] #2494 — .NET Aspire detection sequence (`aspire.md`, duplicated in `generate.md` / `scan.md`)
- [ ] #2495 — azd context detect/apply/verify sequence (`azure-context.md`, duplicated in `aspire.md`)
- [ ] #2496 — Two-phase azd provision/deploy + env-name slug (duplicated across 6 service template/recipe files)
- [ ] #2497 — Per-resource quota check loop (`resources-limits-quotas.md`, duplicated in `plan-template.md`; overlaps `azure-quotas` — likely a shared script)
- [ ] #2498 — Terraform remote-state backend bootstrap (duplicated verbatim in `recipes/terraform/patterns.md` and `recipes/azd/terraform.md`)
- [ ] #2499 — Aspire `AddParameter`/`WithBuildArg` pre-build scan (mandatory bash + PowerShell scan in `recipes/azd/aspire.md`)
- [ ] #2500 — SQL principal env-var setup (`az ad signed-in-user` + `azd env set`, duplicated across `sql-database/{auth,bicep,README}.md`)

### `azure-validate` skill

- [ ] #2501 — Terraform validation preflight sequence (`recipes/terraform/README.md`; 8+ fixed checks + Go-style template scan)
- [ ] #2502 — Bicep validation sequence (`recipes/bicep/README.md`; build/validate/what-if/lint — shares impl with #2503)
- [ ] #2503 — AZCLI validation sequence (`recipes/azcli/README.md`; near-identical to #2502, shared script)
- [ ] #2504 — Aspire post-provision Container Apps env-var setup (`recipes/azd/aspire.md`; query Azure + `azd env set`, overlaps #2500)
- [ ] #2505 — Aspire Functions secret-storage scan (`aspire-functions-secrets.md`; `AddAzureFunctionsProject` scan, overlaps #2494/#2499)

### `azure-diagnostics` skill

- [ ] #2506 — AKS cluster baseline diagnostic sweep (read-only `az aks`/`kubectl` sweep duplicated across 4 files)
- [ ] #2507 — AKS pod-failure evidence bundle (`describe` + `logs --previous` + `top`, repeated 4+ times)
- [ ] #2508 — Inspektor Gadget invocation wrapper (node resolution + pinned version + gadget-type timeout)
- [ ] #2509 — Combined dump-everything diagnostic blocks (already chained scripts in container-apps + app-service)
- [ ] #2510 — Function App telemetry discovery chain (ARG/CLI key->component->workspace + log-flow probe)
- [ ] #2511 — Messaging namespace connectivity/DNS/port probe (`service-troubleshooting.md`; cross-platform)

### `azure-deploy` skill

- [ ] #2512 — Deployment verification + endpoint reporting (resource-list + `/health` + `https://` normalize, duplicated across all 5 recipes)
- [ ] #2513 — AcrPull RBAC propagation health check (identity/scope resolve + poll-with-backoff; already bash+PS)
- [ ] #2514 — `azd env get-values` environment loader (4-file dup; replaces unsafe `eval $(...)`)
- [ ] #2515 — Managed identity SQL access grant (idempotent CREATE USER/ALTER ROLE; overlaps #2500/#2504)
- [ ] #2516 — SQL access / role-membership verification (load-env + `az sql db query`; duplicated)
- [ ] #2517 — Missing container-registry variable population (query-then-`azd env set`; overlaps #2500/#2504)
- [ ] #2518 — Container Apps two-phase image deployment (acr build + registry set + update; already bash+PS)
- [ ] #2519 — Terraform `{{ .Env.* }}` variable resolution gate (detection grep; bash-only, needs PS)

### `azure-enterprise-infra-planner` skill

- [ ] #2521 — Terraform deploy chain (`init`/`plan`/`apply`; already bash+PS; overlaps #2518)
- [ ] #2522 — Bicep validate + `what-if` preview chain (`az bicep build` + scope-aware what-if; overlaps #2512)

### `microsoft-foundry` skill

- [ ] #2525 — Regional quota usage probe (loop over locations + usages query)
- [ ] #2526 — Multi-region quota sweep (per-region usage compare/aggregate)
- [ ] #2527 — Foundry deployment enumeration (list + table-format deployments)
- [ ] #2528 — Model-capacity probe (capacity lookup before deploy)
- [ ] #2530 — Model deploy-and-poll (create deployment + poll provisioning)
- [ ] #2531 — Deployment capacity/name preflight (validate name + capacity)
- [ ] #2532 — Model SKU and quota validation (SKU list + quota check)
- [ ] #2533 — Eval-dataset upload-and-register (upload blob + register dataset)
- [ ] #2534 — Fine-tuned model deploy-and-verify (deploy + verify status)
- [ ] #2535 — Dataset blob download-and-cache (download + local cache)
- [ ] #2536 — Eval-results download-and-summarize (fetch results + summarize)
- [ ] #2537 — Private-network connectivity test (endpoint/DNS reachability)
- [ ] #2538 — Post-deployment infrastructure verification (resource state checks)
- [ ] #2539 — RBAC audit-and-assign (list assignments + assign roles)
- [ ] #2540 — Tracing Insights API fetch (App Insights query)
- [ ] #2541 — Direct-code deploy pipeline (package + deploy app code)
- [ ] #2542 — Toolbox MCP smoke test (start + smoke-check MCP tools)

## Authoring notes (apply to every subtask)

- Create both a bash **and** a PowerShell version of each script.
- Reference scripts with markdown links, not bare paths; include run examples and a brief explanation of what each script does.
- Script output should explain what it did, so the result is understandable without re-inspecting raw command output.
- Run integration tests to verify functionality and that the skill still completes end-to-end.