feat: add private Azure validation pilot foundation

[ruby-dlee]

Intent

Land a reviewable declarative Azure foundation for private scale-to-zero no-mistakes validation cells and policy-grade Crosscheck compartments while Firstmate remains local. The default foundation profile must create zero supervisor and author VMs while preserving separate private validation-control, uncredentialed validation-shard, Crosscheck-reviewer, Crosscheck-tools, and genuinely networkless-verifier boundaries; no VM SSH authorization, public VM IP, public listener, or inbound path is acceptable. Keep exact-subscription binding without changing the ambient Azure CLI default, read-only validation and sanitized what-if, explicit irreversible gates, retained encrypted task/account disks, one task per general worker, scale-to-zero, and the two-phase 1000-dollar target/1500-dollar commissioning policy with no automatic termination. Worker-create must validate and deploy the exact singleton plan without profile reset, destroy must fail closed before mutations when inventory cannot be proven, and worker/state-sync alerts must detect total silence. Do not deploy billable resources, track private identifiers or credentials, buy support, or expand this foundation into remote Herdr, full worker migration, or application protocols. Quota support is captain-owned and non-blocking; validate and ship the committed foundation, including executed regression proof for all exact-head Crosscheck findings.

What Changed

• Add a declarative ARM foundation for private, scale-to-zero Azure validation and Crosscheck compartments, with isolated networking, retained encrypted disks, monitoring, and budget controls.
• Add an operator CLI for exact-subscription validation, sanitized previews, explicitly gated deployment and worker lifecycle operations, singleton worker creation, and fail-closed destruction.
• Document the pilot architecture and operating contract, with regression coverage for isolation, mutation gates, worker plans, silence alerts, and cleanup safety.

Risk Assessment

✅ Low: The follow-up cleanly suppresses all ten supervisor-only resources during singleton worker deployment and makes destroy classify complete VM/disk inventories before any mutation, with targeted structural regressions covering both fixes.

Testing

Completed 1 recorded test check.

• Outcome: ⚠️ 1 error across 1 run (5h6m23s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 3 issues found → auto-fixed ✅

• 🚨 docs/azure-pilot/main.json:1444 - The VM definitions disable password authentication while intentionally omitting linuxConfiguration.ssh.publicKeys. Azure Linux VM provisioning requires an authentication mechanism when password authentication is disabled, so commissioning/full apply and worker-create can fail validation or deployment. This conflicts with the required deployable foundation while SSH authorization is forbidden; use a separately reviewed non-SSH provisioning mechanism supported by Azure rather than an unauthenticated osProfile.
• 🚨 bin/fm-azure-pilot.sh:753 - The required worker-create “exact singleton plan” is not preserved for slots 3–16: line 753 requires capacityProfile=full, but the template conditions the supervisor VM and its identity/NIC/disks on any non-foundation profile. Consequently a singleton worker deployment can also create or reconcile supervisor resources. Gate all non-worker resources on incrementalWorkerDeploy == false, or introduce a worker-only nested deployment boundary.
• 🚨 bin/fm-azure-pilot.sh:836 - The required fail-closed destroy inventory is incomplete: the disk query inventories only disks already carrying the two expected purpose tags, then resource-group deletion destroys every other disk too. An untagged, mistagged, or unexpected disk therefore remains outside the proven inventory but is still deleted. Inventory all disks first and refuse before mutation unless every disk is explicitly classified and authorized.

🔧 Fix: Captain: gate supervisors and fail-close disk destruction
✅ Re-checked - no issues remain.

⚠️ **Test** - 1 error

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; tests/run.sh || rc=1; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"

✅ **Document** - passed

✅ No issues found.

🔧 **Lint** - 1 issue found → auto-fixed ✅

• ⚠️ linter found issues (exit code 1)

🔧 Fix: Add private Azure VM key authentication
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.