Unattended extension install succeeds without applying an explicit version pin #10179

• Make sure you've installed the latest version using instructions

Output from azd version
Installed reproduction: azd version 1.33.0 (commit 29133b640536436db9b56f8db4b1781cb136e5ba) on Windows amd64. Separately reproduced the still-applicable exit-status defect in the real install action on current public core source c4d2ed79b91b5c0a8fef9648d627774bc7c2d180, using an isolated configuration and local artifact fixtures.

Describe the bug
An explicit azd extension install --version ... --no-prompt request can return exit code 0 while retaining a different installed version. When a downgrade or source change requires confirmation and --force is absent, the install is skipped but no error is returned. Automation therefore cannot trust a successful explicit version pin.

The historical 1.33 reproduction also printed a final installed-success message. Current main already avoids that extra message when every installation is skipped; the remaining issue is successful status for an unmet explicit version request.

This was found by internal testing, not reported as a customer incident.

To Reproduce

1. In an isolated AZD_CONFIG_DIR, install azure.ai.dataset version 1.0.0-beta.30 from a registered source that supplies it.
2. Register a second source that supplies version 1.0.0-beta.29.
3. Run azd extension install azure.ai.dataset --version 1.0.0-beta.29 --source historical --no-dependencies --no-prompt without --force.
4. The command reports a skipped replacement and returns success. The installed version and binary hash still identify beta.30.

Current-main action tests additionally reproduce same-source downgrades and cross-source upgrades with an explicit pin. Fresh exact-version installs and forced replacements work.

Expected behavior
Do not silently discard an explicit version request. Preserve replacement/downgrade protection: if confirmation is required but unavailable under --no-prompt, fail with a nonzero status and actionable --force or interactive-confirmation guidance. Leave the installed version and files unchanged on refusal. Preserve same-source/same-version idempotence, ordinary default install semantics, interactive cancellation, fresh installs and confirmed/forced replacement.

Environment
Information on your environment:
* Language name and version: Go 1.26 for current-source regression tests
* IDE and version: N/A; Windows amd64 command line

Additional context
The current-main regression uses the actual install action and extension manager, a mocked registry and isolated local artifacts, checking both persisted version/source and installed SHA-256. No shared extension profile or Azure resource is modified. This differs from azd init validating a project's extension dependency constraint: the command here is a user's direct, explicit extension installation request.