Add agent groups and disabled-agent recommendations

[jebrans]

Summary

• Add product-defined agent groups with list, show, dry-run, and sequential
  installation commands.
• Recommend matching present-but-disabled agents before missing installable
  agents in Claude and Copilot reasoning.
• Validate approved install candidates before package materialization and keep
  group-installed agents disabled until explicitly enabled.

Root cause

TypeAgent had source-level package installation and reasoning-time install
recommendations, but no product-owned grouping workflow. Existing recommendation
discovery also considered schema activity without consistently requiring action
activity, could miss disabled capabilities, and could suggest duplicate installs
for present or unresolved agents.

The provisional group implementation additionally validated preview drift only
after materialization, conflated unresolved records with healthy installs, and
could activate group-installed agents through manifest defaults.

Fix

• Ship and strictly validate data/agentGroups.json.
• Add @package group list|show|install with complete preflight, source
  shadowing, one confirmation, sequential execution, idempotent reruns, and
  truthful per-member results.
• Classify package state as bundled, installed, installed-unavailable,
  transitioning, or absent from maintained in-memory state.
• Re-select the approved source and compare candidate identity before
  materialization.
• Persist group-installed agents as initially disabled without overwriting an
  existing session preference.
• Restrict reasoning action discovery to schemas whose schema and actions are
  both active.
• Return sanitized, bounded, ordered disabled/installable recommendations with
  exact commands and untrusted-metadata guidance.
• Require the group catalog in agent-server bundle assets and validate catalog
  members against workspace package metadata.

Tests

• TypeScript builds: default-agent-provider, agent-dispatcher.
• 99 catalog, group-command, and registry tests.
• 85 installed-provider and package-state tests.
• 24 reasoning and disabled-default tests.
• Circular dependency ratchet.
• Repository-pinned Prettier formatting.

The authenticated production-feed smoke test is included but is currently
blocked in this environment because Azure Artifacts returns HTTP 403 for package
metadata requests. Full bundle/MSI execution is also pending a fully
provisioned dependency install.

Rollout

Keep this PR in draft until:

1. Product owners approve the developer and media taxonomy.
2. The authenticated feed smoke test resolves every catalog member.
3. Command-reference regeneration and full bundle/MSI payload validation pass.

No migration is required. Group installation remains advisory and explicit; it
does not enable agents.

Rollback

Revert the commit. Existing single-agent package commands and reasoning behavior
remain the fallback. Installed agents are stored individually, so no
group-specific runtime data migration or rollback transaction is required.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.