feat(azure): safely purge retained validation cells

[ruby-dlee]

Summary

• add an explicit purge-retained command for failed-retained validation cells
• seal a resumable cleanup plan and terminal tombstone before mutation
• retire the exact allocator fence atomically before irreversible artifact deletion
• verify full same-fence ledger, provider absence, resource identity, RBAC, storage, disk, and release receipts

Safety

• passed, active, foreign, untracked, or changed cells refuse before deletion
• shard-driver and cell lock ordering prevents in-flight shard races
• crash retries resume only the sealed remaining plan
• replacement and new reservations refuse retired fences

Size

This is 1,693 added lines across one cleanup state machine and its owning lifecycle integration. Most of the delta is crash-boundary, race, identity, and mixed-reservation coverage; splitting it would separate the irreversible operation from its admission tests.

Validation

• tests/run.sh tests/fm-azure-validation.test.sh
• tests/run.sh tests/fm-worker-lifecycle.test.sh
• bin/fm-lint.sh
• bin/fm-lint-node.sh
• Python compile, shell syntax, and diff checks
• independent review clear