fix: diagnose unified connection services

[Hui Miao (huimiu)]

Why this is needed

Issue #8710 needs Doctor and next step to diagnose configured Foundry connections consistently. Right now, unified azure.ai.connection services are not merged with bundled agent connections and legacy manifest resources, so enabled connections can be skipped or reported with the wrong remote result. Configuration errors also need to stop remote.connections before any Foundry probe runs.

Why this approach

The collector now reads unified, bundled, and legacy sources, with standalone unified services taking precedence over bundled data and bundled data taking precedence over legacy manifests. It deduplicates and sorts results, while keeping credentials and metadata out of diagnostics. Doctor reports connection load errors before probing, skips when there are no enabled connections, and recommends azd provision for missing remote connections.

A connection condition belongs at the root of azure.yaml, next to host. A root false condition still wins and short-circuits $ref loading. For an enabled service, or one without a root condition, a condition that comes from resolved $ref content is treated as a configuration error, with guidance to move it beside host. Payload conditions do not override the root field. Whitespace-only conditions count as false.

Malformed legacy manifest strictness and target, credentials, and metadata variable validation are out of scope for this diagnostics-only change.

E2E validation

• azd ai agent doctor --local-only passed; remote checks remained excluded.
• azd ai agent doctor passed with an enabled unified connection on the Foundry project; remote.connections passed.
• azd ai agent doctor with a resolved $ref condition failed as expected, with guidance to place condition beside host in azure.yaml.
• azd ai agent doctor with root condition: false and whitespace-only conditions passed; connection checks skipped without resolving broken $ref values.

Closes: #9684

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
20 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
20 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

📋 Prioritization Note

Thanks for the contribution! The linked issue isn't in the current milestone yet.
Thank you for logging this issue; our team is reviewing it. If you need urgent prioritization, tag Rick Winter (@RickWinter) and Kristen Womack (@kristenwomack) to let us know.

[Copilot]

Pull request overview

Adds unified Foundry connection diagnostics across Doctor and next-step state assembly.

Changes:

• Merges enabled unified, bundled, and legacy connections with precedence and sorting.
• Reports configuration errors before connection probing.
• Updates Doctor messaging, resource-ID validation, and tests.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
nextstep/types.go	Adds connection load errors to state.
nextstep/state.go	Invokes unified connection collection.
nextstep/manifest.go	Moves connection collection out of manifest traversal.
nextstep/evaluate.go	Adds condition evaluation helpers.
nextstep/connections.go	Collects and merges connection sources.
nextstep/connections_test.go	Tests collection, conditions, and precedence.
nextstep/condition.go	Uses shared condition evaluation.
doctor/checks_remote_test.go	Updates check-name assertion.
doctor/checks_connections.go	Updates connection diagnostics and validation.
doctor/checks_connections_test.go	Expands Doctor behavior coverage.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.