fix: set CustomClientAppId in BlueprintSubcommand to fix inheritable permissions

[pratapladhani]

Summary

BlueprintSubcommand.SetHandler is missing the assignment of graphApiService.CustomClientAppId, causing a365 setup blueprint to fail when setting inheritable permissions. Every other command handler (AllSubcommand, PermissionsSubcommand, DeployCommand, CleanupCommand) already sets this property correctly.

Fixes #271

Root Cause

When CustomClientAppId is null, MicrosoftGraphTokenProvider omits the -ClientId parameter from the Connect-MgGraph PowerShell command, causing it to fall back to the default SDK client app (14d82eec-204b-4c2f-b7e8-296a70dab67e). This default app lacks the AgentIdentityBlueprint.UpdateAuthProperties.All permission required by SetInheritablePermissionsAsync.

Call chain

BlueprintSubcommand.SetHandler
  → graphApiService.CustomClientAppId is NEVER set (null)
  → SetupHelpers.EnsureResourcePermissionsAsync
    → blueprintService.SetInheritablePermissionsAsync
      → graphApiService.EnsureGraphHeadersAsync(requiredScopes: ["AgentIdentityBlueprint.UpdateAuthProperties.All", ...])
        → _tokenProvider.GetMgGraphAccessTokenAsync(tenantId, scopes, false, customClientAppId: null, ct)
          → Connect-MgGraph WITHOUT -ClientId → uses default SDK app → permission denied

Platform impact

Platform	Behavior
macOS/Linux	Always fails — no WAM broker, must use -ClientId for interactive browser auth
Windows	Intermittent — WAM broker may resolve correct tokens from cache, masking the bug until tokens expire

Fix

One-line addition after config load, matching the exact pattern used in AllSubcommand.cs (line 138):

var setupConfig = await configService.LoadAsync(config.FullName);

// Configure GraphApiService with custom client app ID if available
// This ensures inheritable permissions operations use the validated custom app
// Fixes: https://github.com/microsoft/Agent365-devTools/issues/271
if (!string.IsNullOrWhiteSpace(setupConfig.ClientAppId))
{
    graphApiService.CustomClientAppId = setupConfig.ClientAppId;
}

Testing

• Build: dotnet build -c Release — 0 warnings, 0 errors
• Unit tests: All 17 CleanConsoleFormatterTests pass; no existing tests for BlueprintSubcommand SetHandler path
• Manual verification: The fix ensures Connect-MgGraph -ClientId '<custom-app-id>' is emitted, matching behavior of a365 setup all

Workaround (for users on current release)

Use a365 setup all --skip-infrastructure instead of a365 setup blueprint, as AllSubcommand correctly sets the property.

[Copilot]

Pull request overview

This PR fixes a critical bug where a365 setup blueprint fails to configure inheritable permissions because graphApiService.CustomClientAppId is never set in the command handler. Without this assignment, the Graph API authentication falls back to the default SDK client app which lacks the required AgentIdentityBlueprint.UpdateAuthProperties.All permission. This bug affects all platforms but manifests most consistently on macOS/Linux where WAM (Web Account Manager) is unavailable.

Changes:

• Added graphApiService.CustomClientAppId assignment in BlueprintSubcommand.SetHandler after loading configuration, matching the pattern used in all other command handlers (AllSubcommand, PermissionsSubcommand, DeployCommand, CleanupCommand)