feat: prompt for unresolved network env vars during provision

[huimiu]

Why

Before the unified azure.yaml, unresolved ${VAR} references that backed required infra parameters were prompted for at provision time by core azd's Bicep provider. After moving Foundry provisioning to the extension's in-memory synthesizer (internal/synthesis), an unresolved ${VAR} in a service's network: block now hard-errors with unresolved environment variable ${VAR} instead of prompting — a regression in interactive UX.

This restores prompting on the provision path while keeping CI/CD deterministic.

What

• Synthesizer: resolveVars now returns a typed synthesis.UnresolvedEnvVarError{Name} (same Error() string as before) so callers can detect it with errors.As. Field-context wrapping via %w is preserved.
• Foundry provider: Initialize now runs synthesis through synthesizeWithEnvPrompt, a bounded prompt-and-retry loop. On an unresolved network ${VAR} it prompts for the value, persists it via azd env set, adds it to the env map, and retries. Values entered are saved so later runs and azd env get-values see them.
• --no-prompt / CI/CD: when the host reports "prompt required", the loop returns an actionable dependency error naming the variable (run \azd env set VAR ``), mirroring the existing subscription/location handling. Cancellation is handled the same way.

Resolution order is unchanged: azd environment → process environment → prompt (only when neither has it).

Scope / notes

• Applies to the network: block ${VAR} refs (peSubnet/agentSubnet vnet, dns.subscription) — the only fields the synthesizer resolves.
• The eject path (--infra, PreserveVarRefs: true) is untouched: ${VAR} still passes through verbatim.
• Brownfield (endpoint:) and on-disk ./infra/ Bicep paths are unaffected.
• environment_variables: ${VAR} (resolved at deploy, pushed to the agent container) is not covered here — deploy currently substitutes unset refs to empty silently. That's a separate follow-up.

Tests

• TestSynthesize_UnresolvedVarIsTyped — asserts errors.As extracts *UnresolvedEnvVarError with the name.
• TestSynthesizeWithEnvPrompt_NoClientSurfacesActionableError — the no-client/--no-prompt path yields an actionable dependency error naming the variable.
• Existing network validation tests stay green (error string unchanged).

Draft — opening for design feedback on placement (Initialize vs. a dedicated pre-provision step) and on whether we also want a matching deploy-time check for environment_variables.