Fix Azure lifecycle evidence binding

[howlcipher]

What changed

Fixes integrity gaps in the merged Azure lifecycle without adding a second deployment framework. The workflow now passes its selected region and environment to Terraform, reads application outputs only after the Container App exists, verifies all observed Azure resources against expected tags and region, and compares the deployed Container App image to the approved digest.

The Terraform apply boundary now requires the deployment candidate identity, Docker output uses the bounded redacting subprocess wrapper, and failed health checks collect bounded Container App logs. Cleanup resolves its target resource group from Terraform state rather than a hard-coded name.

Why

The previous workflow could verify a pre-application output, treat an FQDN as a non-URL, and permit environment display/configuration drift. These changes ensure the approved candidate, Terraform artifacts, and Azure observations refer to the same workload.

Validation

• flake8 passed
• mypy passed
• 135 unit/workflow tests passed; Azure integration test skipped by default
• Terraform fmt and validate passed
• deploy preflight correctly stopped without unavailable Azure prerequisites

Full demo-app pytest collection remains blocked in this host because the declared httpx development dependency is not installed. Real Azure execution remains opt-in through RUN_AZURE_INTEGRATION_TESTS=1 and AZURE_DEPLOYMENT_APPROVED=1.