feat: limit deps command to azure.yaml services only

[jongio]

Summary

azd app run (specifically the deps phase) was walking the entire directory tree looking for projects to build, causing it to randomly build unrelated projects. This PR limits dependency installation to only services defined in azure.yaml.

Changes

• New detectProjectsFromAzureYaml() - reads azure.yaml, resolves service project paths, and detects project types (Node, Python, .NET) directly from those paths instead of walking the tree
• Path traversal validation - validates that service project paths stay within the project root (prevents ../../etc style attacks)
• Directory existence check - errors clearly if a service project directory doesn't exist
• Updated help text - deps command now describes azure.yaml-scoped behavior
• 7 new tests - NoAzureYaml, NoServices, MissingProjectDir, NodeProject, IgnoresNonServiceProjects, MultipleServices, PathTraversal

What's NOT changed

• The standalone detectAllProjects() function in core_helpers.go is preserved for future use
• The --services flag filtering via filterProjectsByService() still works as before
• No changes to the run/reqs orchestrator chain

[github-actions]

🚀 Website Preview

Your PR preview was available here.

Preview has been cleaned up as the PR was closed.

[codecov]

Codecov Report

❌ Patch coverage is 81.53846% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.83%. Comparing base (13ccec3) to head (a52ca05).
⚠️ Report is 10 commits behind head on main.

Files with missing lines	Patch %	Lines
cli/src/cmd/app/commands/core_deps.go	83.60%	5 Missing and 5 partials ⚠️
cli/src/cmd/app/commands/deps.go	50.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #147      +/-   ##
==========================================
+ Coverage   54.72%   54.83%   +0.10%     
==========================================
  Files         148      148              
  Lines       22318    22368      +50     
==========================================
+ Hits        12214    12265      +51     
+ Misses       9340     9334       -6     
- Partials      764      769       +5     

Flag	Coverage Δ
unittests	54.83% <81.53%> (+0.10%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
cli/src/cmd/app/commands/deps.go	41.80% <50.00%> (+3.45%)	⬆️
cli/src/cmd/app/commands/core_deps.go	55.10% <83.60%> (+8.16%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🚀 Test This PR

A preview build (0.12.6-pr147) is ready for testing!

🌐 Website Preview

Live Preview: https://jongio.github.io/azd-app/pr/147/

One-Line Install (Recommended)

PowerShell (Windows):

iex "& { $(irm https://raw.githubusercontent.com/jongio/azd-app/main/cli/scripts/install-pr.ps1) } -PrNumber 147 -Version 0.12.6-pr147"

Bash (macOS/Linux):

curl -fsSL https://raw.githubusercontent.com/jongio/azd-app/main/cli/scripts/install-pr.sh | bash -s 147 0.12.6-pr147

Uninstall

When you're done testing:

PowerShell (Windows):

iex "& { $(irm https://raw.githubusercontent.com/jongio/azd-app/main/cli/scripts/uninstall-pr.ps1) } -PrNumber 147"

Bash (macOS/Linux):

curl -fsSL https://raw.githubusercontent.com/jongio/azd-app/main/cli/scripts/uninstall-pr.sh | bash -s 147

---

Build Info:

• Version: 0.12.6-pr147
• Commit: a52ca05
• Release: View pre-release

What to Test:
Please review the PR description and test the changes described there.