feat: route declarative agent lifecycle through wiqd

[llhmm01 (llhmm01)]

Summary

• preserve the existing declarative-agent-developer skill and its DA schema, capability, authentication, localization, and plugin guidance
• route declarative-agent lifecycle operations through the wiqd CLI instead of invoking the ATK CLI directly
• update API/MCP action, deployment, scaffolding, editing, and workspace guidance to use the supported wiqd command surface
• keep reference-only DA guidance usable without requiring a wiqd preflight

Validation

Copilot natural-language E2E

Tested with the standalone wiqd plugin disabled so routing depended on the updated declarative-agent-developer metadata/fallback behavior:

• added an OpenAPI action using wiqd agent add action --openapi-spec ... --operations ...
• added an unauthenticated MCP action using wiqd agent add action --mcp-server-url ... --mcp-auth-type none
• validated and packaged local/dev environments with wiqd agent validate and wiqd agent package
• provisioned a shared dev agent with wiqd agent provision
• exercised the shared-agent patch version bump after M365 rejected a repeated 1.0.0 deployment, then successfully reprovisioned 1.0.1
• shared only with the authenticated test user using wiqd agent share --scope users
• inspected debug logs and confirmed no atk or @microsoft/m365agentstoolkit-cli lifecycle command was invoked

Direct CLI coverage

• wiqd 0.14.0 preflight and wiqd doctor
• wiqd auth status, stale-cache logout, interactive browser login, and authenticated status verification
• wiqd agent create and clean static validation
• OpenAPI action generation and post-generation validation
• MCP none and oauth-dynamic action generation and post-generation validation
• static OAuth and Entra SSO required-credential guards (no fake credentials were used)
• local/dev packaging, local/dev provisioning, user-scoped sharing, share removal, and cloud-resource deletion
• removed all temporary local projects, logs, packages, shares, and provisioned test agents after validation

Publish was intentionally not executed. Static OAuth and Entra SSO were not tested against live providers because no real client credentials were supplied.

Additional checks:

• git diff --check
• skill frontmatter description is 904 characters (limit: 1024)

Scope

This is a compatibility-focused migration: DA authoring knowledge remains in the existing skill, while wiqd becomes the lifecycle execution layer. It does not reorganize the plugin marketplace or remove the existing DA skill/evaluator.

Tracking issue: https://msft.ghe.com/substrate/wiqd/issues/3248

Parent feature: https://msft.ghe.com/substrate/wiqd/issues/1761

[llhmm01 (llhmm01)]

Sébastien Levert (@sebastienlevert), could you please review this PR when you have a chance?

It preserves the existing declarative-agent-developer knowledge while routing declarative-agent lifecycle operations through the wiqd CLI instead of invoking the ATK CLI directly. The create, action, validate, package, provision, and share paths have been exercised locally and through Copilot natural-language flows; publish was intentionally not executed.

This is the Work IQ slice of the broader ATK/wiqd DA unification work. Thanks!

[Ning Tang (tecton)]

It's also better to add WIQD cli as prerequisite.