Replace microsoft-foundry skill RBAC audit-and-assign with a script

@tmeschter is already working on this.

Since Jul 6, 2026.

## Summary

Copilot has identified a portion of a skill that is a good candidate for replacement with a script.

The candidate is the **RBAC audit-and-assign** sequence in the `microsoft-foundry` skill (`rbac/rbac.md`) — deterministic role-assignment audit/validate/assign+verify flows with hardcoded role GUIDs, duplicated across files.

## Candidate description

The skill runs several fixed RBAC command sequences:

1. **Audit** — the same `az role assignment list --scope` run three times with different `--query` projections.
2. **Validate** — get the signed-in user ID, then list role definitions to answer "is this role present?".
3. **Assign + verify** — `az role assignment create` then `list` to confirm (accounting for 1–5 min propagation).
4. **Managed identity** — `PRINCIPAL_ID=$(...)` then `az role assignment create` (get-then-set).

This is a strong script candidate because it is:
- **Deterministic, parameter-only** — literal role GUIDs (e.g. "Foundry User" `53ca6127-db72-4b80-b1b0-d745d6d5456d`) baked in.
- **Redundant calls** — the audit block runs the same `list` three times; a script can run it once and format all three views.
- **Output-heavy → small answer** — validate reduces heavy output to a present/absent answer.
- **Heavily duplicated** — the signed-in-user role query recurs in `create-foundry-project.md` (L35); the "Foundry User" GUID recurs in `post-deployment-validation.md` (L66).

**Sketch — `assign-and-verify-role.{sh,ps1}` (+ an `audit-roles` mode):**
- **Input:** `--assignee`, `--role`, `--scope` (built from sub/rg/account/project).
- **Output:** for assign — create-then-confirm result with propagation handling; for audit — the consolidated multi-view role list; for validate — a "has required role: yes/no".

> Choosing **which** role/scope to grant and least-privilege decisions stay in prose. The create-then-verify mechanics and audit/validate reductions are fully scriptable. Service-principal creation involves secret output — scriptable but the secret-handling portion needs care.

## Affected file and lines

- [`rbac/rbac.md` — audit/validate/assign/managed-identity sequences (L41–L95)](https://github.com/microsoft/GitHub-Copilot-for-Azure/blob/3890cbfb65c548ce8daa96cabd1d8de63f7bbcca/plugin/skills/microsoft-foundry/rbac/rbac.md#L41-L95)
- [`project/create/create-foundry-project.md` — signed-in-user role query (L35)](https://github.com/microsoft/GitHub-Copilot-for-Azure/blob/3890cbfb65c548ce8daa96cabd1d8de63f7bbcca/plugin/skills/microsoft-foundry/project/create/create-foundry-project.md#L35)
- [`resource/private-network/references/post-deployment-validation.md` — Foundry User role assignment (L55–L69)](https://github.com/microsoft/GitHub-Copilot-for-Azure/blob/3890cbfb65c548ce8daa96cabd1d8de63f7bbcca/plugin/skills/microsoft-foundry/resource/private-network/references/post-deployment-validation.md#L55-L69)

## Next steps

1. **Evaluate the candidate** — confirm the steps are stable and parameterizable, and that the script captures everything the skill needs.
2. **Create both a bash _and_ a PowerShell version** of the script so the skill works across platforms.
3. **Run integration tests** to verify the scripts behave correctly and the skill still completes end-to-end.

## Background Information

### Why replace regular steps with scripts

Replacing a regular, well-defined series of steps with a script can:

- **Reduce token usage** — the skill no longer needs to spell out each command and parse large command output inline; the agent invokes one script and reads a compact result.
- **Improve reliability** — the logic is written and tested once, instead of being re-derived by the agent on every run.
- **Improve determinism** — the same inputs always produce the same steps and output, removing run-to-run variation.
- **Improve speed of execution** — a single script call replaces multiple round-trips of command generation, execution, and large-output parsing.

### Authoring notes for the scripts

- **Reference scripts with markdown links**, not just a bare path to the script file.
- **Include examples** in the skill showing how to run each script (sample invocation with arguments).
- **Briefly explain what each script does** where it is referenced.
- **The script output should explain what it did**, so the agent and user can understand the result without re-inspecting raw command output.