fix(ci): enable projects recording for agent playback

[Siglud]

Root cause

Agent init invokes the nested azd ai project add command. The installed production azure.ai.projects binary intentionally excludes the record-proxy transport, so its ARM requests ignore AZD_TEST_HTTPS_PROXY, escape playback, and fail with SubscriptionNotFound for the fixture subscription.

This is a baseline CI failure, not a help-text regression:

• Baseline main failure at c8f657e2611006f25b38766a1a35f10ae88a605f: https://github.com/Azure/azure-dev/actions/runs/35559011106
• docs(ai): standardize connection, project, routine, skill, and toolbox help Azure/azure-dev#10104 failure at 64ad13bf33868625583ffdaf21ac853e2cc81ab4: https://github.com/Azure/azure-dev/actions/runs/35584254108

Minimal fix

Only .github/workflows/test-ext-azure-ai-agents.yml changes (6 additions, 4 deletions):

• Build the projects dependency with the existing -BuildRecordMode switch.
• Keep production extension binaries installed for Tier 0.
• Replace both agents and projects installed binaries with their record builds immediately before Tier 1 playback.

No production transport, tests, cassettes, extension help, or other workflows change. The inline workflow comment documents why both binaries are necessary.

This standalone CI fix is an upstream prerequisite for Azure#10104 and deliberately preserves that PR's strict five-extension scope. Merging this fork PR alone will not fix upstream CI; the workflow change must land in Azure/azure-dev separately.

Validation

Fresh hosted validation for this PR's commit f68c7fe792bf40863343eadf475f5e1feed5becb succeeded: https://github.com/Siglud/azure-dev/actions/runs/35691981986. The projects build/install and unit tests, production Tier 0 tests, record-binary swap, and playback Tier 1 tests all passed.

Performed for this focused change:

• Parsed the workflow YAML and asserted least-privilege permissions, unchanged unrelated steps, both record build flags, artifact source/destination paths, production packaging, Tier 0 -> swap -> Tier 1 ordering, and playback mode.
• Verified the workflow is byte-for-byte identical after newline normalization to the proven workflow in e13f1c5dedb16343581e860b2371cc63186acd17.
• Ran the canonical projects ci-build.ps1 -BuildRecordMode on Windows with Go 1.26.4 and GOWORK=off; both builds succeeded. Binary metadata confirms only the second includes the record tag. Also parsed both extension build scripts with the PowerShell parser.
• git diff --check passed.
• Fork base remains c8f657e2611006f25b38766a1a35f10ae88a605f; upstream main inspected at 4b9896ee2d3b4ac6dabc90dd0105629a14135138. Both three-dot comparisons contain exactly this one workflow. git merge-tree --write-tree upstream/main HEAD succeeds without conflicts, and its result differs from upstream by only this workflow. No other branch was changed.

Additional historical hosted proof: https://github.com/Azure/azure-dev/actions/runs/35580536942 at e13f1c5dedb16343581e860b2371cc63186acd17 succeeded; its logs show all four Tier 0 and all five Tier 1 tests passing with this exact workflow. Tier 0/Tier 1 were not rerun locally in this session. No live recording, deployment, or authentication was performed.

Governance limitation

The fork's PR Governance check requires a closing issue reference. Creating a genuine issue for this CI defect failed with HTTP 410 because Issues are disabled in Siglud/azure-dev. No false closing reference to the unrelated help issue Azure#8506 was added. Governance remains blocked separately from the passing technical checks; no repository settings or governance workflow changes were made.

[github-actions]

🔗 Linked Issue Required

Thanks for the contribution! Please link a GitHub issue to this PR by adding Fixes #123 to the description or using the sidebar.
No issue yet? Feel free to create one!