Add cloud-aware endpoints and harden GCC blueprint setup

[Rick Brighenti (rbrighenti)]

Summary

Adds cloud-aware Microsoft Graph, OAuth authority, and Agent 365 Tools routing, with GCC Moderate validation for ordinary blueprint agents. Commercial endpoints remain the defaults; configurable endpoints and resource mappings do not imply certification of every government cloud.

• Applies validated Graph/authority overrides consistently across setup, authentication, consent, queries, cleanup, and instance creation.
• Uses the configured discovery endpoint's origin for related Agent 365 routes, while preserving explicit create/delete overrides.
• Selects the appropriate Observability resource for the configured environment and migrates stale commercial Observability permissions.
• Makes blueprint discovery and permission reads fail safely instead of creating duplicates or reporting unreadable grants as absent; preserves stored blueprint selection, valid secrets, and customized manifest names.
• Fixes instance consent reporting and registration-only failure exit codes.
• Addresses the remaining review findings: isolates Graph token caches/acquisition locks by normalized authority and tolerates malformed unrelated lookup rows without accepting invalid blueprint results.
• Validates explicit messaging-endpoint create/delete overrides with the same HTTPS URL contract as discovery, rejecting user information, query strings, and fragments while retaining custom paths.
• Integrates current main, including the BYO MCP device-code improvements, without rewriting branch history.

Configuration

For the GCC Moderate scenario exercised here:

export A365_ENVIRONMENT=gcc
export A365_DISCOVER_ENDPOINT_GCC=https://gcc.agent365.svc.cloud.microsoft/agents/v2/discoverMCPServers

GCC Moderate uses the default Graph and authority hosts. The environment name alone does not switch Agent 365 discovery away from the commercial service. Other environments can supply graphBaseUrl / authorityHost in config or higher-precedence A365_GRAPH_BASE_URL_{ENV} / A365_AUTHORITY_HOST_{ENV} variables. Graph/authority overrides must be HTTPS origins; environment suffixes are normalized, e.g. gcc-high becomes GCC_HIGH.

The CLI architecture documentation and Unreleased notes describe the behavior.

Validation evidence

Live results below were obtained on a18beb7de6 before this PR refresh. They are not a claim that the newly merged revision has already completed its live retest.

Area	Observed result
GCC setup and registration	Ordinary-blueprint provisioning, registration reuse/read-back, and separate S2S and OBO agent setup passed. Disposable-resource cleanup was verified in the earlier tenant; retained validation agents were not deleted.
Runtime telemetry	Actual SDK exporters accepted success, controlled-failure, and restart traces in S2S and genuine delegated OBO flows. September 25 replay: six HTTP200 exports, twelve spans.
Defender	The user confirmed visibility in the earlier tenant on September 21. Visibility in the newer tenant remains unconfirmed; ingestion HTTP200 alone is not backend visibility.
MCP sample	Isolated CLI add/list/remove/configuration and scoped token acquisition passed. A Node protocol probe initialized GCC SimpleTools, listed its tools, and called read-only ListSampleProducts, returning Phone, Tablet, Laptop with isError:false.
Review regressions	New tests reproduced the reported defects before the fixes; the focused merged-code run passes 170 tests. The subsequent endpoint-override fix has eight red-before/green-after cases and a passing 73-test endpoint/configuration/messaging selection.
Local suite	With an isolated authentication-cache directory: 2,239 passed, 12 skipped, one host-dependent WSL test failed. The WSL failure and an initial populated-cache failure both reproduce on unchanged main; assertions were not weakened. Local execution uses .NET 10 roll-forward for net8 targets, not native .NET 8 coverage.