[agentfabric] Add Agent Fabric command models

[Kshitija Murudi (kmurudi)]

please provide the link to the corresponding pull request in Azure/azure-cli or Azure/azure-cli-extensions:

Azure/azure-cli-extensions#10370

Summary

• Add the generated agentfabric command models on current main; the merged Agent Mesh removal from [agentmesh] Remove retired Agent Mesh command models #1097 remains intact.
• Preserve the approved public hierarchy:
  • az agentfabric create|show|list|update|delete|wait
  • az agentfabric member create|show|list|update|delete|wait
  • az agentfabric policy-group create|show|list|update|delete|wait
  • az agentfabric aks attach|show|list|update|detach|wait
  • read-only az agentfabric egress-trust-bundle show|list
• Members are Agent Fabric children requiring --fabric-name; Policy Groups remain independent resource-group-scoped Microsoft.NetworkSecurity peers.
• The branch was content-preservingly rebased onto live main 15fd99861efc37ff789567603d0bc39c5a324740 and contains only two commits above that base.

Final source provenance

The latest models are generated from the final RPSaaSMaster Microsoft.NetworkSecurity Agent Fabric preview merged by Azure/azure-rest-api-specs-pr#30665 at commit a52c4fc4ac8cd197d38a1072704853f485cafb6c.

• API version: 2026-10-07-preview
• OpenAPI: specification/networksecurity/resource-manager/Microsoft.NetworkSecurity/agentFabric/preview/2026-10-07-preview/agentFabric.json
• OpenAPI SHA-256: 6de5cd31bbf92e418b5946074bcb3591ca8d30b538521cdf30cd6c24fa35d508
• Provider Operations_List and internal OperationStatus_Get remain excluded.
• Historical 2026-07-21-preview Agent Fabric/Member/Policy Group models and 2026-09-10-preview Cluster Association models remain unchanged.

Latest contract behavior

Agent Fabric

• PUT create/replace supports system-assigned identity plus customer-owned Content Safety connection input through -p/--inspection-profile and retained --content-inspection-profile.
• contentInspectionProfile.apiKey remains a prompted, write-only secret and is absent from GET/list/wait/LRO outputs.
• PATCH update exposes only tags and system-assigned identity.
• resourceGuid uses the final UUID schema and remains read-only.

Members

• PUT create supports ACI, AKS, and AgentFabricSandbox workload discriminators.
• Final ACI workloads add optional agentIdentity; ACI and Agent Fabric sandbox identities require tenant/agent IDs when supplied and accept optional blueprintId.
• memberGuid uses UUID typing with create/read mutability.
• AKS references, dual ACI containerGroups/SandboxGroups resource IDs, endpoint servicePort/protocol/targetPort shapes, and member FQDN PATCH are preserved.
• All five Policy Group policy families remain modeled.

Cluster Associations / agentfabric aks

• Attach is tracked-resource LRO PUT with required location and immutable target resource ID, optional SKU/tags, and no public If-None-Match input.
• Update is the authoritative location-polled PATCH requiring matching properties.clusterResourceId, with optional SKU, tags, and gateway IP through -i/--gateway-ip plus retained --workload-cluster-gateway-ip.
• workloadClusterGatewayIp remains update-only and is intentionally absent from attach/show/list output schemas.
• Item naming retains --association-name, --name/-n, and compatibility alias --cluster-name.
• The shared association wire contract supports managedClusters and SandboxGroups without inventing a new discriminator.

Egress trust bundles

• Read-only agentfabric egress-trust-bundle show|list exposes the service-managed singleton certificates, PEM, SHA-256 thumbprint, bundle version, cache validity/expiry, and provisioning state.
• No mutating egress commands are added.

Generation

• Imported the final Swagger, all 40 examples, and referenced ARM common-types files with aaz-dev 4.7.0 / Python 3.14.
• Selected PATCH-only updates for all four writable item resources.
• Used supported workspace refactoring APIs to preserve the public agentfabric, member, independent policy-group, aks attach/detach, and flattened egress trust-bundle hierarchy.
• Emitted command Markdown plus canonical JSON/XML through WorkspaceManager.generate_to_aaz().
• Regenerated the current Azure CLI extension PR profile for parity: 22 API commands plus four derived waits across 36 generated Python files.

Validation

• Exact contract assertions: passed for all 22 public API commands and 10 latest resource configurations.
• Canonical targeted agentfabric AAZ metadata/model verification: passed.
• Isolated extension regeneration assertions: passed for 26 registrations across 36 Python files.
• Generated Python compileall: passed.
• git diff --check: passed.
• Final PR scope versus live main: 66 files, 27 Commands/agentfabric files, 38 Agent Fabric resource artifacts, one root command-index entry; 10,506 insertions, no deletions, no specs, Agent Mesh, or unrelated model changes.

[Kshitija Murudi (kmurudi)]

Following the same one-module-per-PR split, this PR remains draft and is being rewritten to add only Commands/agentfabric. Removal of Commands/agentmesh is moving to a separate ready PR.