fix: address PR review - array copy safety, retry handling, test coverage

- GetConsentRedirectUris returns defensive copies to prevent mutation of
  shared static arrays
- SetWebConsentRedirectUrisAsync now uses RetryHelper for transient
  Graph failures, consistent with publicClient redirect URI handling
- Add because: clauses to web consent URI test assertions documenting
  the admin consent portal contract
- Add test for web redirect URI update throw path

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: bhaarathms

src/Microsoft.Agents.A365.DevTools.Cli/Services/EntraAppProvisioner.cs

@@ -37,8 +37,8 @@ internal static string[] GetConsentRedirectUris(string environment)
     {
         return environment?.ToLowerInvariant() switch
         {
-            "test" or "preprod" or "ppe" => TestPreProdConsentRedirectUris,
-            _ => ProdConsentRedirectUris,
+            "test" or "preprod" or "ppe" => [.. TestPreProdConsentRedirectUris],
+            _ => [.. ProdConsentRedirectUris],
         };
     }
 
@@ -122,7 +122,10 @@ private async Task SetWebConsentRedirectUrisAsync(
         var resolvedEnvironment = environment ?? Environment.GetEnvironmentVariable("A365_ENVIRONMENT") ?? "prod";
         var consentUris = GetConsentRedirectUris(resolvedEnvironment);
 
-        var success = await _graphApiService.UpdateAppRedirectUrisAsync(tenantId, objectId, consentUris, ct);
+        var success = await _retryHelper.ExecuteWithRetryAsync(
+            async retryCt => await _graphApiService.UpdateAppRedirectUrisAsync(tenantId, objectId, consentUris, retryCt),
+            result => !result,
+            cancellationToken: ct);
         if (success)
         {
             _logger.LogDebug(
@@ -131,7 +134,7 @@ private async Task SetWebConsentRedirectUrisAsync(
         }
         else
         {
-            var msg = $"Failed to set web redirect URIs on {roleDisplay} app '{appName}'.";
+            var msg = $"Failed to set web redirect URIs on {roleDisplay} app '{appName}' after retries.";
             _logger.LogWarning(msg);
             warnings?.Add(msg);
         }

src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/EntraAppProvisionerTests.cs

@@ -186,7 +186,9 @@ public async Task CreatePublicClientsAppAsync_ProdEnvironment_SetsPublicClientAn
             {
                 "https://admin.cloud.microsoft/?ref=tools/consent",
             },
-            opt => opt.WithStrictOrdering());
+            opt => opt.WithStrictOrdering(),
+            because: "Prod consent redirect URIs are required by the admin.cloud.microsoft " +
+                     "consent portal. Changing these URIs breaks the admin consent flow.");
     }
 
     [Theory]
@@ -237,7 +239,10 @@ public async Task CreatePublicClientsAppAsync_TestPreProdEnvironment_SetsTestPre
                 "https://sdf.admin.cloud.microsoft/?ref=tools/consent",
                 "https://ignite.admin.cloud.microsoft/?ref=tools/consent",
             },
-            opt => opt.WithStrictOrdering());
+            opt => opt.WithStrictOrdering(),
+            because: "Test/PreProd consent redirect URIs target the sdf and ignite admin " +
+                     "consent portals. Changing these URIs breaks the admin consent flow " +
+                     "in non-production environments.");
     }
 
     [Fact]
@@ -295,7 +300,7 @@ public async Task CreatePublicClientsAppAsync_WhenWebRedirectUriUpdateReturnsFal
         var result = await _provisioner.CreatePublicClientsAppAsync(ServerName, TenantId, serviceTreeId: null, warnings);
 
         result.ClientId.Should().Be(AppClientId);
-        warnings.Should().ContainSingle().Which.Should().Be($"Failed to set web redirect URIs on Public Clients app '{ServerName}-PublicClients'.");
+        warnings.Should().ContainSingle().Which.Should().Be($"Failed to set web redirect URIs on Public Clients app '{ServerName}-PublicClients' after retries.");
     }
 
     [Fact]
@@ -315,4 +320,24 @@ public async Task CreatePublicClientsAppAsync_WhenRedirectUriUpdateThrows_Return
         result.AppName.Should().Be($"{ServerName}-PublicClients");
         warnings.Should().ContainSingle().Which.Should().Be("Failed to set redirect URIs on Public Clients app: Graph blew up");
     }
+
+    [Fact]
+    public async Task CreatePublicClientsAppAsync_WhenWebRedirectUriUpdateThrows_ReturnsIdsAndAppendsExceptionWarning()
+    {
+        _graph.CreateEntraAppAsync(TenantId, Arg.Any<string>(), serviceTreeId: Arg.Any<string?>(), Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<(string ObjectId, string ClientId)?>((AppObjectId, AppClientId)));
+        _graph.UpdateAppPublicClientRedirectUrisAsync(
+                TenantId, AppObjectId, Arg.Any<string[]>(), Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult(true));
+        _graph.UpdateAppRedirectUrisAsync(
+                TenantId, AppObjectId, Arg.Any<string[]>(), Arg.Any<CancellationToken>())
+            .Returns<Task<bool>>(_ => throw new InvalidOperationException("Graph consent update failed"));
+
+        var warnings = new List<string>();
+        var result = await _provisioner.CreatePublicClientsAppAsync(ServerName, TenantId, serviceTreeId: null, warnings);
+
+        result.ClientId.Should().Be(AppClientId);
+        result.ObjectId.Should().Be(AppObjectId);
+        warnings.Should().ContainSingle().Which.Should().Be("Failed to set redirect URIs on Public Clients app: Graph consent update failed");
+    }
 }