fix(azure): prove fresh worker execution before submit

[ruby-dlee]

Summary

• admit an Azure Managed Run Command with omitted script bytes only when the exact untouched assignment and pending staging sentinels plus the failed preflight instance prove it has never submitted real work
• atomically bind real updates with request-digest and idempotency-key tags so ambiguous replay cannot execute twice
• require any differently bound prior execution to prove a digest-valid terminal result before reuse

Live evidence

A fresh azaccept worker on current main returned no source.script from Azure, while its private staging pair still held the exact unsubmitted sentinels and its preflight instance was Failed/-202. The controller retained the exact execute claim and no task ran.

Verification

• focused worker lifecycle suite
• full worker supervisor, placement, secondmate authority, outcome transport, and Azure pilot suites
• sealed bridge-cutover Python wrapper: 224 tests passed, 2 environment-dependent skips
• pinned lint: 251 scripts
• Python compile, shell syntax, and diff checks