fix: tighten root persistent flag exemption to SDK-created roots only

The root persistent flag skip logic previously exempted ALL flags on
root.PersistentFlags() via pointer equality. This meant an extension
using a plain root (not NewExtensionRootCommand) could add a root
persistent flag colliding with reserved globals without detection.

Now only roots created by NewExtensionRootCommand (marked with an
azd-sdk-root annotation) get the exemption. Extensions using plain
roots have all their root persistent flags validated against the
reserved list.

Adds test proving plain-root collisions are caught.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jongio

cli/azd/pkg/azdext/extension_command.go

@@ -73,6 +73,9 @@ func NewExtensionRootCommand(opts ExtensionCommandOptions) (*cobra.Command, *Ext
 		Short:   opts.Short,
 		Long:    opts.Long,
 		Version: opts.Version,
+		Annotations: map[string]string{
+			"azd-sdk-root": "true",
+		},
 	}
 
 	// Register persistent flags

cli/azd/pkg/azdext/reserved_flags.go

@@ -130,11 +130,13 @@ func collectConflicts(root, cmd *cobra.Command) []FlagConflict {
 		}
 		checked[f.Name] = struct{}{}
 
-		// Skip flags that are the SDK-provided root persistent flags (same object).
-		// Use pointer equality so that a subcommand defining its own flag with the
-		// same name as a root persistent flag is still validated.
-		if rootFlag := root.PersistentFlags().Lookup(f.Name); rootFlag != nil && rootFlag == f {
-			return
+		// Skip only SDK-provided root persistent flags. The annotation check ensures that
+		// extensions using a plain root (not NewExtensionRootCommand) that manually add
+		// root persistent flags colliding with reserved globals are still caught.
+		if root.Annotations["azd-sdk-root"] == "true" {
+			if rootFlag := root.PersistentFlags().Lookup(f.Name); rootFlag != nil && rootFlag == f {
+				return
+			}
 		}
 
 		conflicts = append(conflicts, checkFlag(cmd, f)...)

cli/azd/pkg/azdext/reserved_flags_test.go

@@ -169,3 +169,18 @@ func TestReservedFlagsInSyncWithInternal(t *testing.T) {
 			long, sdkShort, short)
 	}
 }
+
+func TestValidateNoReservedFlagConflicts_NonSDKRootPersistentFlag(t *testing.T) {
+	// An extension that manually adds a root persistent flag colliding with a
+	// reserved global (not via the SDK) should still be caught. This verifies
+	// the tightened exemption: only known SDK globals are exempt, not arbitrary
+	// root persistent flags.
+	root := newPlainRoot("test")
+	root.PersistentFlags().StringP("environment", "e", "", "custom env flag")
+	sub := &cobra.Command{Use: "run"}
+	root.AddCommand(sub)
+
+	err := ValidateNoReservedFlagConflicts(root)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "long flag --environment is reserved")
+}