build-caldova-evidence-agent

# Build Caldova Evidence Agent Use the repository's staged scripts as the source of truth. Do not recreate resources with ad hoc commands when a canonical script exists. ## Workflow 1. Read `README.md`, especially Prerequisites, Portable Configuration, and Security Boundary. 2. Establish fresh state with `az account show`; do not infer subscription or deployment health from terminal history. 3. Confirm the target subscription, tenant, regions, resource group, and naming suffix from environment variables or the defaults resolved by `deploy/00-config.ps1`. 4. Run `deploy/01-preflight.ps1` synchronously. It is read-only. 5. Before creating billable resources, show the resolved target and ask for plain-text approval. 6. For a complete build, run `deploy/Build-All.ps1` synchronously with no timeout. 7. For repair, start at the earliest failed numbered stage and continue through `deploy/11-verify-system.ps1`. 8. Report the App Service URL, hosted-agent version, skill version, SQL MCP endpoint, and verification results. ## Guardrails - Never run `azd ai agent init`; the hosted project is already scaffolded. - Never copy `.env`, `.azure`, `.checkpoints`, `bin`, `obj`, `dist`, or `node_modules` into source control. - Treat `deploy/01-preflight.ps1` as the subscription and quota gate. - Do not weaken the three-tool SQL MCP boundary. - Do not expose secrets or access tokens in output. - Do not delete or recreate the resource group unless explicitly requested.