Add credential-free-dev skill

[ArLucaID]

Core skill for eliminating secrets from Azure apps using managed identities, workload identity federation, and Azure Identity SDK.

What's included

• SKILL.md (155 lines): Core principles, credential type decision table, DefaultAzureCredential chain, RBAC role quick reference, WIF patterns, common pitfalls
• references/migration-patterns.md: Before/after migration code for Azure SQL, Storage, Cosmos DB, Service Bus, Event Hubs, Key Vault, App Configuration across Python, .NET, TypeScript, Java
• references/acceptance-criteria.md: Correct/incorrect patterns for auth, client init, RBAC, MI selection, WIF
• tests/scenarios/credential-free-dev/scenarios.yaml: 6 test scenarios, 100% pass rate
• Symlinks in python/dotnet/typescript/java/rust entra categories
• README.md updated: total 132->133, Core 9->10, test coverage updated

Test results

Scenarios: 6 | Passed: 6 | Pass Rate: 100.0% | Average Score: 100.0

[ArLucaID]

@thegovind / @spboyer : Could I get some help in merging this one? I don't have permissions to request reviewers.

[thegovind]

@ArLucaID - Could you resolve the merge conflict?

[thegovind]

Review summary

The credential-free-dev skill content is solid (good RBAC table, clean migration guidance, correct DAC chain). But the PR has a few real blockers around scope/branch hygiene, broken symlinks, and a direct conflict with PR #199's auth guidance.

Issues

🔴 Blocking

1. Scope creep — two skills bundled into one PR

The PR title is "Add credential-free-dev skill" but the branch contains three commits, including two for entra-agent-id:

• cdb4bfc — Add entra-agent-id skill
• 72a5710 — feat: Add runtime token exchange to entra-agent-id
• b68f0ce — Add credential-free-dev skill (the actual PR)

Result: 13 files change, ~800 of the 1669 added lines belong to a different skill that's covered by PR #195. Please rebase b68f0ce onto main (or wait for entra-agent-id PRs to merge first) so this PR carries only the credential-free-dev commit.

2. Symlinks in skills/{python,dotnet,java,rust,typescript}/entra/credential-free-dev are committed as plain text files, not symlinks

$ file skills/python/entra/credential-free-dev
skills/python/entra/credential-free-dev: ASCII text, with no line terminators

The file just contains the literal string ../../../.github/skills/credential-free-dev. Compare to a working sibling:

lrwxr-xr-x   azure-identity      -> ../../../.github/skills/azure-identity-py
-rw-r--r--   credential-free-dev   ❌ regular file

Fix:

for lang in python dotnet java rust typescript; do
  rm "skills/$lang/entra/credential-free-dev"
  (cd "skills/$lang/entra" && ln -s ../../../.github/skills/credential-free-dev credential-free-dev)
done
git add skills/

This usually happens when the file is staged/committed on Windows or via the GitHub web editor — please verify after the fix that git ls-tree HEAD skills/python/entra/credential-free-dev reports mode 120000, not 100644.

3. Direct conflict with PR #199 on the production-auth recommendation

This PR (line 26 of credential-free-dev/SKILL.md) teaches:

"DefaultAzureCredential is the standard entry point. Unified credential chain that works locally and in production (managed identity) without code changes."

PR #199 (same author, same area) reverses this and recommends ManagedIdentityCredential in production, citing the Azure SDK best-practices doc that explicitly warns against DefaultAzureCredential in production due to credential-chain probing, latency, and silent fallback. Two skills landing simultaneously with contradictory production guidance is bad for the catalog.

Please decide which is canonical and reconcile both PRs before merge. If #199 is the intended final state, this skill needs the same treatment (or should land after #199 with consistent wording).

🟡 Recommended

• entra-agent-id/SKILL.md L53 regression: <your-tenant-id> was changed to <your tenant-id> (hyphen → space). Same finding I left on #195 — please drop that hunk.
• README.md test totals. The PR bumps Core to 8 skills / 78 scenarios (+6 from tests/scenarios/credential-free-dev/scenarios.yaml), but the global totals row and the per-language rows should be re-summed by tests/ rather than hand-edited. Worth running the test harness or counting script after rebase.

🟢 Nits

• SKILL.md "Common Pitfall #5" links to managed-identities-status — fine, but consider also linking the canonical "services that support Microsoft Entra authentication" page; that's the more actionable list when someone is migrating off keys.
• "Stepping stone" wording for Key Vault references is terse — consider: "Intermediate step — secrets in Key Vault rather than config; not the end state."
• The migration-patterns reference is the right structure, but make sure the per-service code blocks specify the non-async path for languages where folks copy-paste in scripts (e.g., Python sync BlobServiceClient alongside aio variant).

Once the branch is rebased and the symlinks are fixed, the skill content itself looks good to merge — pending the #199 reconciliation.