feat(agents): add microsoft.foundry service target for a single hosted agent

[huimiu]

What

Wires the new host: microsoft.foundry service target in the azure.ai.agents extension — the foundation of design spec #8590 (§2.1, §2.2, §2.6). A single microsoft.foundry service represents a whole Foundry project, with agents declared inline as top-level service properties delivered on ServiceConfig.AdditionalProperties (not under config:).

This foundation makes a single hosted agent deployable end-to-end by mapping the inline agent definition onto the existing agent deploy machinery.

Changes

• Wiring — register microsoft.foundry in listen.go (WithServiceTarget) and declare the provider in extension.yaml.
• Config binding (foundry_config.go) — typed FoundryProjectConfig / FoundryAgent aligned with Agent.json / microsoft.foundry.json from feat(agents): add microsoft.foundry azure.yaml schema #8603; bound from AdditionalProperties. Includes validation (single hosted agent, exactly one deploy mode, project requirement) and conversion to agent_yaml.ContainerAgent.
• Provider (service_target_foundry.go) — implements the full ServiceTargetProvider interface:
  • Initialize: bind + validate + resolve project root + shared auth setup.
  • Package/Publish/Deploy for one hosted agent: prebuilt image: → CreateAgentVersion; code-deploy runtime: (python/dotnet) → ZIP package + create/update version. ${VAR} resolved / ${{...}} preserved via the shared ExpandEnv (feat(agents): support Foundry ${{...}} server-side expressions in env expansion #8602).
  • Endpoints / GetTargetResource delegate to the shared implementation.
• Surgical refactor of service_target_agent.go — extract setupAuth (shared env/credential setup) and zipSourceDir (shared code packaging) so both hosts reuse them; azure.ai.agent behavior is unchanged.
• Tests (foundry_config_test.go) — table-driven coverage for binding from AdditionalProperties, validation cases, runtime/entry-point mapping, and ${VAR}/${{...}} env resolution.

Out of scope (follow-ups)

• Multi-agent fan-out, bounded concurrency, per-agent error attribution.
• Container (docker:) builds for the new host (core does not drive a per-agent container build yet — rejected with an actionable error).
• Data-plane reconcile: deployments, connections, toolboxes, skills, routines (§2.8).
• $ref include resolution wiring (feat(agents): resolve $ref file includes with overlay overrides in Foundry config #8627) and instructions prompt-file loading.
• init rework and old-file deprecation.

Notes

• Code-deploy entry point is derived from startupCommand (the agent schema models entry via startupCommand, not an explicit field); documented as the seam if the schema later adds one.
• The new host does not trigger the legacy azure.ai.agent lifecycle hooks in listen.go (they are gated on the old host), so the foundation correctly does not inherit their data-plane reconcile.

Testing

Extension module (azureaiagent): go build ./..., go vet ./..., gofmt, golangci-lint run (0 issues), full go test ./..., and cspell — all clean.

Fixes #8628