[Change Safety] Generator: emit static -AcquirePolicyToken/-ChangeReference on write cmdlets (Stage D)

[YangAn-microsoft]

Summary

Emits the Change Safety opt-in parameters -AcquirePolicyToken (SwitchParameter) and -ChangeReference (string) as static [Parameter] properties on generated Azure management-plane write-verb cmdlets, for modules that opt in via a change-safety config flag. Their values flow through the cmdlet's BoundParameters to the module-level pipeline step in Az.Accounts (Azure/azure-powershell#29840), which calls acquirePolicyToken and stamps the x-ms-policy-external-evaluations header.

Replaces #1548. That PR surfaced the parameters via a runtime-wired VTable GetDynamicParameters delegate + generated IDynamicParameters. Per review feedback the approach moved to codegen-owned static parameters — simpler, self-contained in the generated cmdlet, and with no cross-repo runtime coupling. Design write-up: Azure/CLIPS#408.

What it does

• New implementChangeSafetyParameters() in cmdlets/class.ts, invoked from init().
• Opt-in flag: a change-safety config value (default false), read into Project.changeSafety in internal/project.ts. Nothing is emitted unless a module sets change-safety: true in its readme. This keeps the ~180-module rollout deliberate (a module opts in alongside bumping its Az.Accounts minimum) rather than triggered by any unrelated regeneration.
• Gates (all must hold to emit): change-safety: true → state.project.azure → not data-plane (endpointResourceIdKeyName, matching module-class.ts's isDataPlane) → HTTP verb ∈ {PUT, POST, DELETE, PATCH}.
• Parameter names + help text are reused verbatim from azure-powershell-common's ChangeSafetyParameters, so SDK and AutoRest cmdlets present identically to users.
• No IDynamicParameters, no Module.cs/.psm1 wiring, no module-class.ts / powershell-declarations.ts changes.

Scope

Two files: powershell/cmdlets/class.ts and powershell/internal/project.ts. With the flag off (the default), every module is a zero diff. With the flag on, read cmdlets (Get/List/Show/Test), data-plane cmdlets, and non-azure projects still get a zero diff.

Verification

• npm run build + npm run eslint: clean.
• Smoke-gen of an azure management-plane spec (get/delete/put/patch): flag off → 0 params emitted; flag on → all 4 write cmdlets get both parameters (category Azure, ChangeReference with ValidateNotNull), the read (Get) cmdlet gets none.
• tests-sdk1-support (-AllowList -SkipCsharp): 52 × Equal — unaffected. That suite compares the shared SDK/model layer; cmdlets are PowerShell-only and out of scope.

Dependencies / release order

• Pairs with the Az.Accounts pipeline step: [Change Safety] Az.Accounts: AutoRest AcquirePolicyToken pipeline step (Stage A) azure-powershell#29840 (Stage A) — the consumer of BoundParameters.
• Depends on the shared core: Refactor: extract shared PolicyTokenAcquirer + ChangeSafetyParameters (Change Safety – Stage 0) azure-powershell-common#454 (Stage 0) — owns the parameter names/help text.
• Kept draft: regenerated cmdlets only take effect once this generator and Az.Accounts are released and modules opt in + regenerate (pilot: Cdn).