Policy fragment still referenced by the service policy cannot be deleted #261

Command that triggered the bug

apiops publish --delete-unmatched

Expected behavior

Description

When pruning policy fragments, the CLI attempts to delete fragments that are still
referenced by the service-level policy (/policies/policy). APIM rejects the delete:

ERROR DELETE policyfragment/<fragment-name>: HTTP 400:
{"error":{"code":"ValidationError","message":"The Policy Fragment '<fragment-name>'
is used by the following entities:\r\n/policies/policy\r\n","details":null}}

This happened for multiple fragments in one run (all referenced by /policies/policy).

Root cause

Delete ordering removes resources in reverse dependency tiers (4 → 3 → 2 → 1), and policy
fragments are deleted in the last tier. However, the referencing resource — the
service-level policy that includes these fragments — is not removed or replaced before
the fragments it references. A policy fragment cannot be deleted while any policy still
references it, so the delete fails.

Expected behavior

• The referencing service policy should be deleted/updated to drop the fragment references
  before the referenced policy fragments are deleted, or
• Fragments that are still referenced should be skipped with a clear warning rather than
  producing a hard error, or
• Delete ordering should account for fragment-to-policy references explicitly.

Actual behavior

Actual behavior

• Every policy fragment referenced by /policies/policy fails to delete with HTTP 400
  The Policy Fragment '<name>' is used by the following entities: /policies/policy.

Steps to reproduce

1. Target an APIM instance that contains: an API with multiple revisions, and policy
   fragments referenced by the service-level policy.
2. Run publish with delete/prune enabled using an artifact set that does not include
   those resources (so they are pruned).
3. Observe the delete errors above in the publish summary.

apiops CLI version

1.0.0

Environment details

• VSCode: DevContainer
• @azure-tools/apiops-cli v1.0.0
• Command: publish with delete/prune (--delete-unmatched)

CI/CD environment

None

Is this bug blocking you?

None