feat(prompts): add camera onboarding agent with discovery workflow

[kgmwang1]

Description

Introduces a new custom agent (camera-onboarding) that automates camera discovery and configuration generation for edge application deployments. The agent accepts sparse camera input (IP + credentials + label), probes devices to build a full capability manifest, then generates deployment-ready Terraform and environment configurations for 500-level apps.

Related Issue

Relates to #

Type of Change

• New feature (non-breaking change which adds functionality)
• Documentation update

Implementation Details

Camera Onboarding Agent (.github/agents/camera-onboarding.agent.md)

A 5-phase autonomous workflow:

1. Input Ingestion — validates sparse YAML with IP, credentials (env var refs only), and labels
2. Discovery — probes cameras via vendor-specific adapters (Reolink, Hikvision, Dahua, generic ONVIF) to populate a ~25-field manifest per device (streams, PTZ, AI detection, security state)
3. Target App Selection — maps discovered capabilities to eligible apps (508-media-connector, 510-onvif-connector, Camera Dashboard)
4. Credential Resolution — collects secret reference strategy (K8s Secret, Azure Key Vault, or inline dev-only)
5. Config Generation — outputs Terraform namespaced_devices/namespaced_assets and env var configs, with file placement and deployment guidance

Supporting Materials

File	Purpose
copilot/research/camera-discovery-research-topic.md	Research topic definition
copilot/research/camera-discovery/01-architecture-concept.md	Architecture and adapter design
copilot/research/camera-discovery/01-scope-statement.md	Manifest schema rationale and field justification
.github/agents/camera-onboarding/examples/site-cameras-input.yaml	Example sparse input
.github/agents/camera-onboarding/examples/site-manifest.yaml	Example full discovery manifest

Privacy & Security Mitigations

• Passwords must use ${ENV_VAR} syntax — literal credentials rejected at input validation
• Generated configs emit credential references only (from Phase 4), never raw passwords
• Discovery manifests classified as CONFIDENTIAL with a prepended classification header
• Default output path is .local/camera-discovery/ (untracked); agent warns before writing to tracked paths
• Recommends .gitignore entries for manifest artifacts

Target Applications

App	Generated Config
508-media-connector	Terraform devices + RTSP capture task assets
510-onvif-connector	Terraform ONVIF devices + PTZ management groups
Camera Dashboard	CAMERA_URLS, CAMERA_NAMES env vars

Testing Performed

• Manual validation

Validation Steps

Invoke via VS Code Copilot Chat:

Checklist

• I have updated the documentation accordingly
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification

Additional Notes

None.

---

🤖 Crafted with precision by ✨Copilot following brilliant human instruction,
then carefully refined by our team of discerning human reviewers.