feat: add --filter support to apiops publish

[Chris Dayne (cdayne)]

Summary

Adds --filter <path> and --no-transitive flags to apiops publish, using the same filter YAML file, matching rules, and transitive-dependency resolution that apiops extract --filter already provides. Also corrects three stale/incorrect passages in docs/guides/filtering-resources.md.

Fixes#215
Fixes#228

What's included

--filter / --no-transitive for apiops publish

• Publish can target a subset of resources with --filter ./filter.yaml, reusing the exact filter semantics from extract: case-insensitive names, wildcards, !-prefix exclusions, and nested API/workspace sub-filters.
• Transitive dependency resolution is on by default: referenced named values, backends (including backend pool members), policy fragments, and version sets are pulled into the publish set automatically. --no-transitive disables this and publishes only exact filter matches.
• --filter composes with --commit-id (incremental publish) and --dry-run. In incremental mode, a filter-eligible resource that didn't itself change in the given commit is still (re)published when its parent resource does (e.g. a product's associations, policy, or an API's child resources/revisions).
• Association and subscription targets (GatewayApi, ApiTag, Product↔API/Group links, Subscription↔API/Product) are verified against the artifacts on disk before being created, so a filter-matched but never-extracted target is skipped with a clear warning instead of failing at the APIM API call.
• --delete-unmatched is mutually exclusive with both --filter and --commit-id, with a clear error message.

Workspace-scoped extraction

• apiops extract now resolves transitive dependencies (named values, backends including pool members, and policy fragments) for workspace-scoped APIs, matching the transitive resolution top-level (non-workspace) extraction already had.

Docs

• docs/guides/filtering-resources.md: corrected the resource-type count (16 → 17, after the policies field was added), replaced an incorrect apiSubFilters top-level-key YAML example with the correct nested-object syntax (matching docs/commands/extract.md), and documented the !-prefix exclusion syntax that contradicted an earlier "no exclude syntax" claim.
• docs/commands/publish.md and README.md: documented the new flags and their interaction with --delete-unmatched.
• docs/architecture.md: added the Publish Service → Filter + Transitive Resolver edge the new code introduces to the component diagram.

Test plan

• npm run lint — clean
• npx tsc --noEmit — clean
• npm test — 1153/1153 passing, including coverage for filter matching and transitive expansion in full/incremental/dry-run modes, incremental-mode republishing of unchanged children, the association/subscription existence check, and workspace-scoped transitive extraction
• Manual smoke test against a real APIM instance

[Chris Dayne (cdayne)]

@microsoft-github-policy-service agree