Add private network agent setup with implicit capability hosts

[Jeremy Kramer (JKrame)]

Summary

• add Scenario 22 for a network-secured Foundry Agent Service deployment
• use project capabilitySettings and account network injection for implicit capability-host provisioning
• include fresh and existing project entry points, BYO resource support, deployment scripts, and architecture diagrams
• regenerate ARM template and parameter artifacts from the current Bicep sources

Validation

• compiled main.bicep, add-project.bicep, and add-existing-project.bicep with zero errors
• compiled all three corresponding .bicepparam files with zero errors
• verified azuredeploy.json and azuredeploy.parameters.json are byte-for-byte reproducible
• ran git diff --cached --check