feat(agents): eject Bicep for existing Foundry projects

[Zhijie Huang (hund030)]

Summary

Fixes #9127. Existing Foundry projects can now eject Bicep with azd ai agent init --infra and use the same provisioning path as newly created projects without attempting to recreate the account or project.

Changes

• azure.ai.agents: eject the complete static Bicep tree for endpoint-based projects, preserve environment references, and reject unsupported networking or literal credentials before writing infra/.
• azure.ai.projects: reconcile model deployments, connections, and new or existing ACR resources against an existing project while retaining the no-work endpoint-only path.
• synthesis/templates: replace the separate brownfield template with one conditional account/project resource graph and regenerate the embedded ARM template.

Design Details

• foundryAccountName == '' selects greenfield creation; otherwise conditional existing account/project declarations target the configured brownfield resources.
• A single fully qualified modelDeployments collection works with either account path. Greenfield-only project-name validation runs in a conditional module, so existing project names are preserved.
• Provider-owned target and ACR parameters override on-disk values, secure ARM parameters are omitted from provisioning responses, and endpoint-derived canonical outputs cannot be replaced by stale or empty template outputs.
• Brownfield deployments use a separate deployment name and derive subscription/resource-group context from AZURE_AI_PROJECT_ID; endpoint-only projects still skip ARM when no reconciliation is required.

Manual Validation

• Ran azd ai agent init --infra --no-prompt against an existing Foundry project; it emitted the full static Bicep tree without modifying azure.yaml.
• Ran azd provision --preview --no-prompt from the ejected project; Bicep compiled successfully and preview reported the existing Foundry account and project as skipped.

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).
20 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Hi @Zhijie Huang (@hund030). Thank you for your interest in helping to improve the Azure Developer CLI experience and for your contribution. We've noticed that there hasn't been recent engagement on this pull request. If this is still an active work stream, please let us know by pushing some changes or leaving a comment. Otherwise, we'll close this out in 7 days.