Add JavaScript production readiness guide, skill, and hardened samples

[Joel Mut (sw-joelmut)]

Important

This PR provides a bounded production readiness path for JavaScript and TypeScript Agents SDK code. It does not certify a deployment. Production promotion still requires deployed security, traffic protection, telemetry, state recovery, alert, smoke, and rollback evidence.

Fixes #692

Description

Adds a production readiness guide, AI skill, executable reference sample, and production-hardened AutoSignIn sample for the Microsoft 365 Agents SDK.

The implementation targets Azure Bot Service Web Chat, Azure App Service, managed identity, and durable Blob state.

Changes

Production guidance and AI skill

• Add a normative JavaScript production readiness guide.
• Add the agents-sdk-to-prod skill.
• Guide users through discovery, assessment, agreement, implementation, verification, and handoff.
• Limit the skill to Agents SDK code and its direct production support files.
• Add readiness statuses, maturity states, conditional controls, dependencies, and evidence rules.
• Update plugin discovery metadata and version to 1.2.0.

Production reference sample

• Add a deterministic Web Chat support-intake reference.
• Add validated production configuration and exact audience checks.
• Add managed-identity Blob state.
• Add payload limits, safe errors, health probes, telemetry, and graceful shutdown.
• Add App Service, Azure Bot, Web Chat, Storage, identity, and monitoring Bicep.
• Add deployment, rollback, smoke-test, and operations guidance.

Dependencies and security

• Declare Agents SDK packages as direct dependencies.
• Update the sample to Agents SDK 1.7.
• Add secure transitive dependency overrides.
• Keep local client-secret configuration separate from the managed-identity production path.
• Document the required external caller-aware traffic-protection layer.

Testing

The following image shows the deployed production sample working, and an example of using the skill with an existing auto-signin sample