feat: Add GCC government cloud support

[aaronba]

This PR adds support for GCC (Government Community Cloud) environments to the Copilot Studio CLI skills. Previously, all endpoints were hardcoded to the commercial (public) cloud, making the tools unusable for government customers.

Changes

scripts/src/shared-auth.js — Shared authentication (builds on #133 refactor):

• Added AZURE_PS_CLIENT_ID and PAC_CLI_CLIENT_ID constants alongside existing VSCODE_CLIENT_ID
• Added getDefaultClientId(cloud, scope) — scope-based client ID routing for government clouds
• Added getLoginAuthority(cloud, tenantId) — returns cloud-appropriate login authority
• Updated createMsalApp(), getOrAcquireToken(), getOrAcquireIslandToken(), and all token acquisition functions to accept and thread a cloud parameter

scripts/src/manage-agent.js — Clone, push, pull, list, and publish operations:

• Added --cloud CLI parameter (public | gcc | gcchigh) and CPS_CLOUD environment variable
• Added CLOUD_ENDPOINTS configuration mapping cloud → BAP host, token scopes, login authority, and Island API cluster category
• Added detectCloud() — auto-detects cloud from Dataverse URL (crm9.dynamics.com → GCC)
• Threaded cloud parameter through all token acquisition and API calls

scripts/src/chat-with-agent.js — Chat/test operations:

• Added --cloud CLI parameter and CPS_CLOUD environment variable
• Added CLOUD_CONFIG with per-cloud Power Platform scope, login authority, and environment API domain
• Fixed PowerPlatformCloud enum mapping: Gov (not Gcc) to match the @microsoft/agents-copilotstudio-client SDK
• Added PAC CLI client ID (9cee029c...) as default for SDK chat in all clouds — it is pre-authorized for CopilotStudio.Copilots.Invoke (bonus: commercial SSO agents no longer require --client-id)
• Updated DirectLine domain and SDK cloud settings for government endpoints

Cloud endpoint mapping

Service	Commercial	GCC
BAP Host	api.bap.microsoft.com	gov.api.bap.microsoft.us
BAP Scope	service.powerapps.com	gov.service.powerapps.us
PP Scope	api.powerplatform.com	api.gov.powerplatform.microsoft.us
Login Authority	login.microsoftonline.com	login.microsoftonline.com
Island cluster	category 5	category 6

Client ID discovery

Government clouds require specific client IDs because not all first-party apps are pre-authorized for all resource principals:

Client ID	Name	Dataverse	BAP	Island API	CopilotStudio.Invoke
51f81489...	VS Code	✅	❌ GCC	❌ GCC	❌
1950a258...	Azure PowerShell	✅	✅	✅	❌
9cee029c...	PAC CLI	✅	✅	❌	✅

The implementation uses scope-based selection in GCC:

• Dataverse (*.dynamics.com/.default): VS Code client ID (unchanged)
• Island API (api://.../.default): Azure PowerShell client ID
• BAP / PowerApps: PAC CLI client ID
• CopilotStudio SDK: PAC CLI client ID

Auto-detection

When --cloud is not specified, the cloud is auto-detected from the Dataverse environment URL:

• *.crm9.dynamics.com → GCC
• Everything else → public (commercial)

Testing

All 14 operations tested against live GCC and Commercial environments:

Operation	GCC (crm9.dynamics.com)	Commercial (crm.dynamics.com)
list-envs	✅	✅
list-agents	✅	✅
clone	✅	✅
pull	✅	✅
push	✅	✅
publish	✅	✅
chat-with-agent	✅	✅

Breaking changes

None. The default cloud is public, preserving existing behavior. The --cloud parameter and CPS_CLOUD env var are additive.