Add Azure diagnostic pipeline evidence gates

[Desalzes]

Summary

Fixes #1624.

This strengthens azure-review so diagnostic settings cannot pass CIS Section 5 from existence alone. It requires evidence for subscription and resource diagnostic coverage, required categories/category groups, destination retention, destination hardening, authorization scope, and sample log delivery.

Changes

• Added a Diagnostic Pipeline Integrity Review step.
• Added AZ-DIAG-01 through AZ-DIAG-05 finding IDs for missing resource coverage, category gaps, retention gaps, destination hardening gaps, and missing sample delivery.
• Added a Diagnostic Pipeline Evidence report table.
• Expanded Section 5 checklist patterns for Azure diagnostics, Key Vault AuditEvent, category_group = "allLogs", destination retention/hardening, CMK, and Not Evaluable sample delivery.
• Added a common pitfall and changelog entry.

Validation

• git diff --check
• frontmatter required-field check
• prompt-injection pattern scan for the modified files
• markdown fence balance check