feat: Add warnings for role assignment issues in RBAC checks

[therealjohn]

Dont block deployment of agents on permissions, just warn the user. Fixes #7810

[Copilot]

Pull request overview

This PR changes RBAC pre-flight and postdeploy RBAC behavior in the azure.ai.agents extension to avoid blocking deployments when role assignments can’t be written, surfacing permissions issues as warnings instead.

Changes:

• Converted several RBAC “missing permission/role” failures (notably 403 Forbidden) into user-facing warnings to allow deployments to proceed.
• Added warning-colored output for RBAC issues using output.WithWarningFormat.
• Updated agent identity RBAC assignment to treat 403 during role assignment as non-fatal.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go	Replaces hard RBAC failures with warning output for developer role/permission checks.
cli/azd/extensions/azure.ai.agents/internal/project/agent_identity_rbac.go	Treats 403 role-assignment failures for agent identities as warnings and continues.

[therealjohn]

/check-enforcer override

Rereviewing

[jongio]

Two post-merge observations:

1. ensureSingleAgentRBAC is called from goroutines (line 244) but the new warning writes multi-line output to stdout via fmt.Printf. If multiple agents hit 403 simultaneously, the output could interleave. The old code returned errors to the results slice and printed serially after wg.Wait(). Consider collecting warnings the same way - add a warning string field to agentResult and print after the wait.

2. Three error codes in codes.go are now unused: CodeDeveloperMissingAIUserRole, CodeDeveloperMissingRoleAssignWriteRole, and CodeDeveloperMissingACRRole. Minor dead code to clean up.

[jongio]

This warning runs inside a goroutine (called at line 244 in the concurrent agent RBAC loop). If multiple agents hit 403 simultaneously, the multi-line output could interleave with other goroutine output. The old code returned errors to the results slice and printed them serially after wg.Wait().

Consider collecting warnings the same way:

type agentResult struct {
    name    string
    err     error
    warning string // collect warning text here
}

Then print warnings after wg.Wait() in the serial reporting loop. This keeps the warning-not-error behavior while avoiding interleaved output.