Canvas: update Foundry skill from the latest release instead of main

[qinezh]

Problem

The Microsoft Foundry Canvas currently checks and downloads the Foundry skill from the moving main branch of microsoft/azure-skills:

• SKILLS_TARBALL_URL uses archive/refs/heads/main.tar.gz.
• Remote version checks try raw main and master URLs.

This can install content that has not been published in an Azure Skills release and differs from Foundry DevPack, which resolves the latest GitHub release and compares the skill's metadata.version before updating.

Canvas source: microsoft/Skylight/microsoft-foundry-canvas/src/skills/skills.mjs

Proposed change

Resolve the latest stable microsoft/azure-skills GitHub release, read the microsoft-foundry skill version at that tag, and download that tagged archive only when its metadata.version is newer than the installed version.

Preserve the current behavior of keeping the installed skill when release lookup, version parsing, download, or extraction is uncertain.

Acceptance criteria

• Canvas no longer reads the Foundry skill from moving main or master branches.
• A missing skill is installed from the latest stable Azure Skills release.
• An installed skill is updated only when the released skill's metadata.version is newer.
• The existing skill remains untouched on network, metadata, or extraction failure.
• Session skill reload still occurs after a successful install or update.
• Tests cover install, update, same/older version, and failure paths.

[microsoft-github-policy-service]

Thank you for contacting us! Any issue or feedback from you is quite important to us. We will do our best to fully respond to your issue as soon as possible. Sometimes additional investigations may be needed, we will usually get back to you within 2 days by adding comments to this issue. Please stay tuned.