[ext-foundry]: wire $ref file includes + overlay overrides for separate-services azure.yaml

[huimiu]

Implements unified azure.yaml spec #8590 (docs/specs/unify-azure-yaml/spec.md) §2.4 for the separate-services shape.

Extends the resolver foundation from #8626 (closed; agents-extension $ref resolver over parsed config) to the separate-services layout, shares it across the Foundry sibling extensions, and adds the shared $ref-aware YAML edit helper that the #8049 composition commands also need.

Summary

Let large resource entries live in their own files, pulled in with $ref beside host:, with sibling-key overlay overrides and correct per-file path rebasing — across every Foundry resource service.

Scope

• Service-entry-level $ref include (next to host: and the service key); deployment $ref at the array-item level on the project service.
• Shallow sibling overlay: keys alongside $ref replace the loaded file's top-level keys wholesale.
• Per-file path rebasing for project, instructions, and nested $ref (each loaded file anchored to its own directory).
• Reuse the Resolve $ref file includes with overlay overrides in Foundry config #8626 resolver and wire it across the sibling providers (project / connection / toolbox / skill / routine / agent).
• One shared $ref-aware YAML edit helper, shared with the Add connections, models, tools, and skills to Foundry Agent projects after init #8049 add commands so reads and writes agree.

Out of scope (follow-ups)

• Remote (URL) $ref fetching (deferred per Resolve $ref file includes with overlay overrides in Foundry config #8626).
• JSON-Schema validation of loaded entries.
• Built-in Bicep / provision-less flow (separate RFC).

Related

3-PR follow-up to #8590 / #8675:

• [ext-agents]: evolve azure.ai.agent to service-level shape, retire agent.yaml, add migration #8773 — agent shape + migration
• [ext-foundry]: make project/connection/toolbox Foundry resources real service targets #8774 — per-resource service targets
• [ext-foundry]: wire $ref file includes + overlay overrides for separate-services azure.yaml #8775 — $ref file includes (this issue)

Depends on #8774 (resources must exist as real services to attach $ref).