Summary

azd ai agent endpoint update already supports PATCH on agents (protocols, traffic routing, auth, agent card). Two UX enhancements are needed:

1. azd ai agent endpoint show [name]

Display the current agent endpoint configuration:

• Protocols (responses, a2a, mcp, etc.)
• Version selector / traffic split rules
• Authorization schemes (Entra / Header isolation)
• Agent card (description, skills)

2. Auth-change breaking-change warning

When endpoint update detects that authorization_schemes.isolation_key_source is changing (especially Entra to Header), show a confirmation prompt warning that existing callers will immediately receive 400 errors unless they add the x-ms-user-isolation-key header. --force skips the prompt.

Context

PATCH /agents/{name} supports 4 scenarios:

1. Protocol enablement - a2a, mcp, activity
2. Traffic routing / Canary deployment - version_selector
3. Authorization configuration - isolation_key_source
4. Agent Card - A2A discovery (description + skills)

All are already functional via azd ai agent endpoint update. This issue adds observability (show) and safety (auth warning) only.