Validate tenant ID match against subscription's actual tenant in agent init

[Copilot]

When AZURE_TENANT_ID was already set in the azd environment, tenant resolution was skipped entirely — meaning a stale or mismatched tenant could silently cause auth failures when targeting a Foundry project in a different tenant.

Changes

• exterrors/codes.go: Added CodeTenantMismatch = "tenant_mismatch" to validation error codes.
• cmd/init.go: LookupTenant now runs unconditionally. After the lookup:
  • Empty AZURE_TENANT_ID → set from lookup (unchanged behavior)
  • Non-empty AZURE_TENANT_ID that differs from the subscription's tenant → return a Validation error, consistent with the existing subscription_mismatch / location_mismatch pattern:

} else if currentTenant.Value != tenantResp.TenantId {
    return nil, exterrors.Validation(
        exterrors.CodeTenantMismatch,
        fmt.Sprintf("tenant ID mismatch: environment has %s but project uses %s", currentTenant.Value, tenantResp.TenantId),
        "update or recreate your environment with 'azd env new'",
    )
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.