feat: prompt for unresolved network env vars during provision

[huimiu]

Why

Before the unified azure.yaml, unresolved ${VAR} references that backed required infra parameters were prompted for at provision time by core azd's Bicep provider. After moving Foundry provisioning to the extension's in-memory synthesizer (internal/synthesis), an unresolved ${VAR} in a service's network: block now hard-errors with unresolved environment variable ${VAR} instead of prompting — a regression in interactive UX.

This restores prompting on the provision path while keeping CI/CD deterministic.

What

• Synthesizer: resolveVars now returns a typed synthesis.UnresolvedEnvVarError{Name} (same Error() string as before) so callers can detect it with errors.As. Field-context wrapping via %w is preserved.
• Foundry provider: Initialize now runs synthesis through synthesizeWithEnvPrompt, a bounded prompt-and-retry loop. On an unresolved network ${VAR} it prompts for the value, persists it via azd env set, adds it to the env map, and retries. Values entered are saved so later runs and azd env get-values see them.
• --no-prompt / CI/CD: when the host reports "prompt required", the loop returns an actionable dependency error naming the variable (run \azd env set VAR ``), mirroring the existing subscription/location handling. Cancellation is handled the same way.

Resolution order is unchanged: azd environment → process environment → prompt (only when neither has it).

Scope / notes

• Applies to the network: block ${VAR} refs (peSubnet/agentSubnet vnet, dns.subscription) — the only fields the synthesizer resolves.
• The eject path (--infra, PreserveVarRefs: true) is untouched: ${VAR} still passes through verbatim.
• Brownfield (endpoint:) and on-disk ./infra/ Bicep paths are unaffected.
• environment_variables: ${VAR} (resolved at deploy, pushed to the agent container) is not covered here — deploy currently substitutes unset refs to empty silently. That's a separate follow-up.

Tests

• TestSynthesize_UnresolvedVarIsTyped — asserts errors.As extracts *UnresolvedEnvVarError with the name.
• TestSynthesizeWithEnvPrompt_NoClientSurfacesActionableError — the no-client/--no-prompt path yields an actionable dependency error naming the variable.
• Existing network validation tests stay green (error string unchanged).

Draft — opening for design feedback on placement (Initialize vs. a dedicated pre-provision step) and on whether we also want a matching deploy-time check for environment_variables.

[microsoft-github-policy-service]

Hi @@huimiu. Thank you for your interest in helping to improve the Azure Developer CLI experience and for your contribution. We've noticed that there hasn't been recent engagement on this pull request. If this is still an active work stream, please let us know by pushing some changes or leaving a comment. Otherwise, we'll close this out in 7 days.