fix(azure): purge multi-round shard lineages

[ruby-dlee]

Summary

• admit later-round standalone shard roots only when the controller dispatch record deterministically binds them
• preserve exact shard, task, generation, command, SKU, capacity-fence, release-receipt, provider-zero, and compute-zero proofs
• reject mismatched and foreign lineage before any purge mutation

Verification

• full Azure validation suite
• real failed-retained cell dry planner: 16 terminal lineages, 17 exact capacity constituents, one control release
• full pinned ShellCheck across 252 scripts
• Python compile and diff checks
• independent adversarial review: clear