chore: migrate lab Bicep extensions to GHCR

[willdavsmith]

Summary

Migrate the two active lab Radius Bicep extension references to br:ghcr.io/radius-project/bicep-types-radius:edge and enable experimentalFeaturesEnabled.ociEnabled in both effective configs. Lab 001's development ACR latest becomes GHCR edge; lab 002 retains edge intent.

Preserve all four checked-in local custom extension references and packages, all resource declarations, and unrelated recipes/images/settings. In particular, lab 001's radiusData provides the custom Radius.Data/postgreSqlDatabases type; it is not an obsolete built-in per-namespace alias and must not be collapsed into radius. No radiusCompute/radiusSecurity aliases or active AWS extension consumers were found. No stable/version/digest pins needed migration, and no tooling/framework pins are introduced.

Keep this PR draft. Pre-merge gates:

• Complete the coordinated publishing/release prerequisites: radius-project/radius#13119, radius-project/radius#13177, radius-project/radius#13178, and radius-project/radius#13181, including the immutable foreign-release prerequisite tracked by radius-project/radius#12970.
• Confirm canonical GHCR artifacts and the selected edge tag are public. Both canonical Radius and AWS anonymous pull-token endpoints currently return HTTP 403; AWS is a parent rollout gate, not a new lab consumer.
• Use a compatible released Radius CLI and its matching Bicep compiler, not a branch build. Released Radius v0.61.1 pins Bicep v0.46.1 in pkg/cli/bicep/tools/download_tools.go. The local standalone Bicep reports 0.46.1 (545b338e2c), but local rad version reports Radius 0.60.0 / Bicep 0.42.1. No machine-wide tooling was changed; full released-Radius integration is still unverified.
• Restore and compile all nine lab templates from a clean cache without registry credentials, including the existing custom packages, and resolve any compatibility errors before merging. HTTP 403 means this gate is blocked, not passed.

Reason for change

Adopt the approved production ACR-to-GHCR extension migration for active lab consumers. No issue is automatically closed.

A tracked-text scan found no remaining azurecr.io references after these two substitutions. The local custom aliases remain intentional. Neither lab consumes br:ghcr.io/radius-project/bicep-types-aws, so no AWS entry is added. No historical material, Test-tenant settings, recipe/image registries, deployments, publishing workflows, registry visibility/settings, or ACR resources are changed.

How to test

Passed:

• python3 -m json.tool 001-customer-support-agent/radius/bicepconfig.json > /dev/null
• python3 -m json.tool 002-order-console/radius/bicepconfig.json > /dev/null
• git diff --check
• git grep -n -I -e 'azurecr\.io' -- . returned exit 1 with no matches, the expected clean inventory result.
• An executed Python assertion check compared both configs to git show HEAD:<path> before committing: only the Radius URI and OCI flag changed; all local artifact paths still exist; these two configs are the nearest effective config for all six lab 001 templates and all three lab 002 templates.

Existing Markdown lint failures, no new diagnostics:

npx --yes --package markdownlint-cli2 markdownlint-cli2 --config .github/linters/.markdownlint-cli2.yaml README.md 001-customer-support-agent/README.md 002-order-console/README.md

Executed markdownlint-cli2 0.23.3 / markdownlint 0.41.1 using the existing repository configuration. Exit 1: 54 existing findings. The same command against an untouched git archive HEAD snapshot taken before the commit returned exit 1 with 55 findings. A diagnostic-multiset comparison passed: zero added diagnostics; the root README now has its missing final newline. Existing table formatting, HTML and code-fence findings are out of scope. No dependency manifest or lockfile was added.

Live extension compilation blocked:

• rad version — executed; local Radius 0.60.0 / Bicep 0.42.1 (older than the compatibility baseline).
• bicep --version — executed; standalone Bicep 0.46.1 (545b338e2c).
• bicep restore --pattern '*/radius/**/*.bicep' --force and bicep restore 001-customer-support-agent/radius/app.bicep --force returned exit 0, but this is not extension-restore proof: actual compilation below fails.
• With HOME, AZURE_CONFIG_DIR, and DOCKER_CONFIG pointed at a fresh isolated temporary directory, executed bicep build "$template" --stdout for every path returned by git ls-files '*.bicep'. All 9/9 exited 1 with BCP192 and GHCR HTTP 403 for br:ghcr.io/radius-project/bicep-types-radius:edge. Coverage: lab 001 app, env, shared-resources, recipes agent, blobstorage, postgres; lab 002 app, environments azure, kubernetes. No output was written into the repository. Local custom references produced no separate errors, but full type compatibility cannot be certified while the remote Radius artifact is unavailable.
• curl -sS -o /dev/null -w 'Anonymous GHCR Radius token: HTTP %{http_code}\n' 'https://ghcr.io/token?service=ghcr.io&scope=repository:radius-project/bicep-types-radius:pull' — HTTP 403.
• curl -sS -o /dev/null -w 'Anonymous GHCR AWS token: HTTP %{http_code}\n' 'https://ghcr.io/token?service=ghcr.io&scope=repository:radius-project/bicep-types-aws:pull' — HTTP 403.

The README documents rerunning actual builds in a clean unauthenticated environment after publication. No relevant automated Bicep/config test suite is defined in this repository; application runtime tests and cloud deployment were not run for this config/docs-only change. This PR does not claim live compilation, deployment, or release integration passed.

File change summary

File	Summary of change
001-customer-support-agent/radius/bicepconfig.json	Canonical GHCR Radius edge, OCI enabled; three local custom extensions preserved.
002-order-console/radius/bicepconfig.json	Canonical GHCR Radius edge, OCI enabled; local Dapr extension preserved.
README.md	Shared migration scope, released-tool compatibility, public artifact/tag and anonymous compile gates, explicit blocked status.
001-customer-support-agent/README.md	Distinguish remote Radius from local custom extensions and link prerequisites.
002-order-console/README.md	Distinguish remote Radius from local Dapr extension and link prerequisites.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None