fix(crosscheck): retry malformed Azure Pi artifacts

[ruby-dlee]

What this changes

Azure Pi reviews now allow one clean output-protocol correction when Pi exits zero with a safely completed stream but returns an empty, malformed, non-object, or incomplete outer artifact.

• The first invocation is unchanged. Provider failures and unsafe terminal streams still fail without correction.
• A correction deletes the first result and event files, reuses the same account/model/effort/generation arguments, prepends a fixed trusted instruction, and leaves the original prompt plus its exact wrapper schema as the final bytes.
• No byte from the first response enters the correction prompt, and no third attempt is possible.
• Each invocation's stderr is captured separately. Surfaced artifact and stderr diagnostics are control-escaped and byte-bounded before they can reach Azure Run Command output.
• The existing final wrapper gate remains authoritative.

The adjacent Azure guide now records all four discarded PR #285 live attempts and the unproven status of this one-shot correction.

Why

After the fenced-verdict parser and exact wrapper-schema fixes landed, two live PR #285 compartment attempts still returned prose-only final text. Both were correctly discarded. This narrow retry gives Pi one output-only correction inside the same credentialed compartment without broadening provider, stream, identity, schema, or attempt-count acceptance.

Verification

• tests/run.sh tests/fm-crosscheck-azure.test.sh
• tests/run.sh tests/fm-crosscheck.test.sh
• bin/fm-lint.sh (251 scripts)
• shell syntax and Python compilation checks
• diff integrity checks
• independent review of the initial commit found unbounded raw Pi stderr; the amended commit captures, escapes, caps, and regression-tests both attempts' stderr

The executable regression extracts the exact shipped Pi branch. It covers valid-first, corrected prose/incomplete/non-object artifacts, provider and terminal failures without retry, hostile control-laden stderr, oversized artifacts, second-attempt process failure, stale-result removal, exact retry arguments and generation, schema-last prompt construction, no prior-output feedback, and the two-call ceiling.

No Azure action is part of this PR. The live PR #285 review will be retried only after this change is reviewed, green, and merged.